Wireshark Tip 4: Finding Suspicious Traffic in Protocol Hierarchy

Name: Wireshark Tip 4: Finding Suspicious Traffic in Protocol Hierarchy
Uploaded: 2013-07-20T12:21:34-07:00
Duration: 315 s
Description: This tip was released via Twitter (@laurachappell). When you suspect a host has been compromised, always open the Protocol Hierarchy window. Look for unusual applications (such as IRC or TFTP) or the dreaded "data" right under IP, TCP or UDP.