Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
Chris Sanders · No Starch Press · Third edition · 2017
Identifier: ISBN 978-1-59327-802-1
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
How to read a packet capture with Wireshark: capture placement and filtering, the protocols you will actually meet, and worked scenarios that move from a symptom to a conclusion about what the network did.
Who it is for, and when
The prerequisite for anyone who will be handed a PCAP in a case and asked what it shows. It teaches the habit of reading the capture rather than the tool summary, which is what lets you answer a question about a specific conversation rather than a general one about traffic volume. The publisher gives away Chapter 4 and, more usefully, the full set of capture files with published hashes, so you can work the scenarios before buying.
What it does not cover
A Wireshark and troubleshooting book, not a forensics book: nothing on capture authentication, chain of custody for network evidence, or presenting packet evidence to a court. Written to Wireshark 2.x, so the interface instructions no longer match the current release, and its examples predate the near-total TLS encryption, QUIC and encrypted DNS you will meet in a live capture.
Go to the source
Open at nostarch.com (opens in a new tab)https://nostarch.com/packetanalysis3
Details
- Type
- Book
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Author
- Chris Sanders
- Publisher
- No Starch Press
- Version verified
- Third edition
- Year
- 2017
- Identifier
- ISBN 978-1-59327-802-1
- Topics
- network, foundations, log-analysis
- Checked at source
Related entries
The post-conference edited volumes of the annual IFIP Working Group 11.9 International Conference on Digital Forensics, published by Springer as the numbered Advances in Digital Forensics series. Volume XX covers the twentieth conference and appeared in 2025; the working group's site lists the twenty-third conference for January 2027, so the series is live.
A NIST Special Publication that sets out a four-phase forensic process (collection, examination, analysis, reporting) and applies it to four data sources: files, operating systems, network traffic, and applications. It is written for organisations building forensic capability inside an incident response function rather than for law enforcement labs.
A daily handler diary — distinct from the SANS DFIR blog — in which a rotating roster of volunteer handlers writes up whatever they are currently seeing in honeypot data, malware samples, exploit traffic and log telemetry.
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs — connections, HTTP requests, DNS queries, TLS handshakes, files seen — using its own scripting language. Suricata, from OISF, is a signature and rule-driven IDS/IPS that also produces rich EVE JSON records and can extract files.
The incident response process as a discipline: preparation, detection and initial response, live collection from Windows and Unix, forensic duplication, network evidence, evidence handling, then analysis of hosts, traffic, attacker tools and routers, and report writing.