Wireshark Analysis

Use Cases

• Network troubleshooting and connectivity issues
• Security incident investigation
• Malware traffic analysis
• Performance monitoring and optimization
• Protocol learning and education

Outputs / Deliverables

Primary Outputs

• Filtered packet captures for specific traffic
• Reconstructed communication streams
• Traffic statistics and visualizations
• Evidence documentation for incidents

Core Workflow

Phase 1: Capturing Network Traffic

Start Live Capture

Begin capturing packets on network interface:

1. Launch Wireshark
2. Select network interface from main screen
3. Click shark fin icon or double-click interface
4. Capture begins immediately

Capture Controls

Capture Filters

Apply filters before capture to limit data collection:

# Capture only specific host
host 192.168.1.100

# Capture specific port
port 80

# Capture specific network
net 192.168.1.0/24

# Exclude specific traffic
not arp

# Combine filters
host 192.168.1.100 and port 443

Phase 2: Display Filters

Basic Filter Syntax

Filter captured packets for analysis:

# IP address filters
ip.addr == 192.168.1.1              # All traffic to/from IP
ip.src == 192.168.1.1               # Source IP only
ip.dst == 192.168.1.1               # Destination IP only

# Port filters
tcp.port == 80                       # TCP port 80
udp.port == 53                       # UDP port 53
tcp.dstport == 443                   # Destination port 443
tcp.srcport == 22                    # Source port 22

Protocol Filters

Filter by specific protocols:

# Common protocols
http                                  # HTTP traffic
https or ssl or tls                   # Encrypted web traffic
dns                                   # DNS queries and responses
ftp                                   # FTP traffic
ssh                                   # SSH traffic
icmp                                  # Ping/ICMP traffic
arp                                   # ARP requests/responses
dhcp                                  # DHCP traffic
smb or smb2                          # SMB file sharing

TCP Flag Filters

Identify specific connection states:

tcp.flags.syn == 1                   # SYN packets (connection attempts)
tcp.flags.ack == 1                   # ACK packets
tcp.flags.fin == 1                   # FIN packets (connection close)
tcp.flags.reset == 1                 # RST packets (connection reset)
tcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN-only (initial connection)

Content Filters

Search for specific content:

frame contains "password"            # Packets containing string
http.request.uri contains "login"    # HTTP URIs with string
tcp contains "GET"                   # TCP packets with string

Analysis Filters

Identify potential issues:

tcp.analysis.retransmission          # TCP retransmissions
tcp.analysis.duplicate_ack           # Duplicate ACKs
tcp.analysis.zero_window             # Zero window (flow control)
tcp.analysis.flags                   # Packets with issues
dns.flags.rcode != 0                 # DNS errors

Combining Filters

Use logical operators for complex queries:

# AND operator
ip.addr == 192.168.1.1 && tcp.port == 80

# OR operator
dns || http

# NOT operator
!(arp || icmp)

# Complex combinations
(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443

Phase 3: Following Streams

TCP Stream Reconstruction

View complete TCP conversation:

1. Right-click on any TCP packet
2. Select Follow > TCP Stream
3. View reconstructed conversation
4. Toggle between ASCII, Hex, Raw views
5. Filter to show only this stream

Stream Types

Stream Analysis Tips

• Review request/response pairs
• Identify transmitted files or data
• Look for credentials in plaintext
• Note unusual patterns or commands

Phase 4: Statistical Analysis

Protocol Hierarchy

View protocol distribution:

Statistics > Protocol Hierarchy

Shows:
- Percentage of each protocol
- Packet counts
- Bytes transferred
- Protocol breakdown tree

Conversations

Analyze communication pairs:

Statistics > Conversations

Tabs:
- Ethernet: MAC address pairs
- IPv4/IPv6: IP address pairs
- TCP: Connection details (ports, bytes, packets)
- UDP: Datagram exchanges

Endpoints

View active network participants:

Statistics > Endpoints

Shows:
- All source/destination addresses
- Packet and byte counts
- Geographic information (if enabled)

Flow Graph

Visualize packet sequence:

Statistics > Flow Graph

Options:
- All packets or displayed only
- Standard or TCP flow
- Shows packet timing and direction

I/O Graphs

Plot traffic over time:

Statistics > I/O Graph

Features:
- Packets per second
- Bytes per second
- Custom filter graphs
- Multiple graph overlays

Phase 5: Security Analysis

Detect Port Scanning

Identify reconnaissance activity:

# SYN scan detection (many ports, same source)
ip.src == SUSPECT_IP && tcp.flags.syn == 1

# Review Statistics > Conversations for anomalies
# Look for single source hitting many destination ports

Identify Suspicious Traffic

Filter for anomalies:

# Traffic to unusual ports
tcp.dstport > 1024 && tcp.dstport < 49152

# Traffic outside trusted network
!(ip.addr == 192.168.1.0/24)

# Unusual DNS queries
dns.qry.name contains "suspicious-domain"

# Large data transfers
frame.len > 1400

ARP Spoofing Detection

Identify ARP attacks:

# Duplicate ARP responses
arp.duplicate-address-frame

# ARP traffic analysis
arp

# Look for:
# - Multiple MACs for same IP
# - Gratuitous ARP floods
# - Unusual ARP patterns

Examine Downloads

Analyze file transfers:

# HTTP file downloads
http.request.method == "GET" && http contains "Content-Disposition"

# Follow HTTP Stream to view file content
# Use File > Export Objects > HTTP to extract files

DNS Analysis

Investigate DNS activity:

# All DNS traffic
dns

# DNS queries only
dns.flags.response == 0

# DNS responses only
dns.flags.response == 1

# Failed DNS lookups
dns.flags.rcode != 0

# Specific domain queries
dns.qry.name contains "domain.com"

Phase 6: Expert Information

Access Expert Analysis

View Wireshark's automated findings:

Analyze > Expert Information

Categories:
- Errors: Critical issues
- Warnings: Potential problems
- Notes: Informational items
- Chats: Normal conversation events

Common Expert Findings

Quick Reference

Keyboard Shortcuts

Common Filter Reference

# Web traffic
http || https

# Email
smtp || pop || imap

# File sharing  
smb || smb2 || ftp

# Authentication
ldap || kerberos

# Network management
snmp || icmp

# Encrypted
tls || ssl

Export Options

File > Export Specified Packets    # Save filtered subset
File > Export Objects > HTTP       # Extract HTTP files
File > Export Packet Dissections   # Export as text/CSV

Constraints and Guardrails

Operational Boundaries

• Capture only authorized network traffic
• Handle captured data according to privacy policies
• Avoid capturing sensitive credentials unnecessarily
• Properly secure PCAP files containing sensitive data

Technical Limitations

• Large captures consume significant memory
• Encrypted traffic content not visible without keys
• High-speed networks may drop packets
• Some protocols require plugins for full decoding

Best Practices

• Use capture filters to limit data collection
• Save captures regularly during long sessions
• Use display filters rather than deleting packets
• Document analysis findings and methodology

Examples

Example 1: HTTP Credential Analysis

Scenario: Investigate potential plaintext credential transmission

1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters

Finding: Credentials transmitted in cleartext form data.

Example 2: Malware C2 Detection

Scenario: Identify command and control traffic

1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns

Indicators:

• Regular timing intervals
• Encoded/encrypted payloads
• Unusual ports or protocols

Example 3: Network Troubleshooting

Scenario: Diagnose slow web application

1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss

Finding: TCP retransmissions indicating network congestion.

Troubleshooting

No Packets Captured

• Verify correct interface selected
• Check for admin/root permissions
• Confirm network adapter is active
• Disable promiscuous mode if issues persist

Filter Not Working

• Verify filter syntax (red = error)
• Check for typos in field names
• Use Expression button for valid fields
• Clear filter and rebuild incrementally

Performance Issues

• Use capture filters to limit traffic
• Split large captures into smaller files
• Disable name resolution during capture
• Close unnecessary protocol dissectors

Cannot Decrypt TLS/SSL

• Obtain server private key
• Configure at Edit > Preferences > Protocols > TLS
• For ephemeral keys, capture pre-master secret from browser
• Some modern ciphers cannot be decrypted passively

When to Use

This skill is applicable to execute the workflow or actions described in the overview.