Packet Analysis Fundamentals with Wireshark
What Wireshark shows
Each packet is decoded into layers (Ethernet, IP, TCP/UDP and the application protocol). The interface has a packet list, a details pane and a bytes pane.
Capture safely and legally
Capture only on networks you own or may monitor, and treat captures as sensitive: they can contain passwords and personal data. For practice, use sample captures or your own lab traffic — or our Cleartext Credentials challenge. See the Wireshark tool page.
Capture filters vs display filters
| Capture filter | Display filter | |
|---|---|---|
| When | Before recording | After recording |
| Syntax | BPF, e.g. host 192.0.2.10 and tcp port 80 |
Wireshark, e.g. http.request.method == "POST" |
| Purpose | Reduce data captured | Find packets of interest |
Useful display filters:
dns
tcp.flags.syn == 1 && tcp.flags.ack == 0
http.request
ip.addr == 192.0.2.10
Follow a conversation
Right-click a packet → Follow → TCP Stream to read the whole exchange. For an unencrypted HTTP login you will see the form fields in clear text — a vivid reason to use HTTPS (see HTTP and HTTPS).
Command-line version
tshark -r capture.pcap -Y "http.authorization" -T fields -e http.authorization
-r reads a file, -Y applies a display filter, -T fields -e prints chosen fields.
A first investigation routine
- Statistics → Conversations to see who talked to whom.
- Filter by protocol (
dns,http,tls). - Look for unusual destinations, large transfers and cleartext protocols.
- Export objects (File → Export Objects) in a sandbox if you need the files.
Background: networking fundamentals and how DNS works.
Related tool: tcpdump
Use techniques only on systems you are authorised to test.