GO KALI FREE
BeginnerTools

Wireshark Guide: Network Protocol Analysis

Master Wireshark for network traffic capture, protocol analysis, filtering, and troubleshooting with practical examples.

#wireshark#packet analysis#network protocol#traffic capture#packet sniffer

Why You Need Wireshark

You need to inspect network traffic at the packet level — Wireshark captures and decodes hundreds of protocols in real time. Whether you are troubleshooting a slow connection, analyzing a malware beacon, or learning how TCP handshakes work, Wireshark shows you exactly what is on the wire.

Prerequisites

  • Basic understanding of networking concepts (TCP/IP, OSI model)
  • Familiarity with common protocols (HTTP, DNS, DHCP)
  • Administrative/root access to capture packets

    • Installation

    # Debian/Ubuntu
sudo apt install wireshark
# macOS
brew install --cask wireshark
# Windows: Download from wireshark.org

    Capturing Traffic

    sudo tshark -i eth0
sudo tshark -i eth0 -w capture.pcapng
sudo tshark -i eth0 -f "port 80" -w http-traffic.pcapng

    Understanding the Interface

    Packet List Pane: Summary of all packets with time, source, destination, protocol, info.

    Packet Details Pane: Protocol layers in expandable tree structure.

    Packet Bytes Pane: Raw packet data in hex and ASCII.

    Capture Filters (BPF Syntax)

    port 80
host 192.168.1.100
port 53
net 192.168.1.0/24
not arp and not icmp

    Display Filters

    http
dns
tcp.port == 80
ip.addr == 192.168.1.1
http.request.method == "POST"
tcp.flags.syn == 1 and tcp.flags.ack == 0
dns.qry.name contains "google"

    Following Streams

    Right-click a packet and select Follow > TCP Stream to see the full conversation.

    {@visual wireshark-tcp-handshake}

    Statistics and Analysis

    Protocol Hierarchy, Conversations, Endpoints, IO Graph, Flow Graph, Expert Info.

    Common Mistakes

    Capturing without filters on busy networks. Forgetting promiscuous mode. Wrong interface selected.

    Best Practices

    Use capture filters for large networks. Save with descriptive names. Master keyboard shortcuts.

    Related Tools

  • **Tcpdump**: Command-line packet capture
  • **TShark**: CLI version of Wireshark
  • **NetworkMiner**: Network forensic analysis

    • Related Articles

  • [Tcpdump Guide](/articles/tcpdump-guide)
  • [Networking Basics](/articles/networking-basics)
  • [HTTP vs HTTPS](/articles/http-vs-https)

    • Summary

    Wireshark is the premier network protocol analyzer. Effective use requires understanding capture and display filters, following protocol streams, and leveraging statistics tools.

    Knowledge Check

  • What is the difference between capture and display filters?
  • How do you follow a TCP stream?
  • What is promiscuous mode?
  • How can you decrypt TLS traffic?
  • What does the Expert Info feature do?

    • References

    {@ref wireshark-docs}

    {@ref rfc793}

    {@ref kali-tools}

    Frequently Asked Questions

    What is Wireshark and what is it used for?

    Wireshark is the world's most widely used network protocol analyzer. It captures packets in real time and displays them in detailed, human-readable format. It is essential for network troubleshooting, security analysis, protocol development, and education.

    What is the difference between capture and display filters?

    Capture filters (BPF syntax) are applied during packet capture, reducing file size by excluding unwanted traffic. Display filters are applied after capture, hiding packets from view without deleting them. Use capture filters for large networks to manage file sizes.

    How do you follow a TCP stream in Wireshark?

    Right-click any packet in the conversation and select Follow > TCP Stream. This reconstructs the full application-layer data exchange, showing HTTP requests/responses, credentials, or other protocol data in a readable format.

    What is promiscuous mode in Wireshark?

    Promiscuous mode allows the network interface to capture all packets on the network segment, not just those addressed to it. This is essential for monitoring traffic between other devices on the same network for security analysis.

    How can you decrypt TLS traffic in Wireshark?

    Provide the SSLKEYLOGFILE environment variable pointing to a file where browsers write session keys, or import the server's private key. Wireshark uses these to decrypt TLS traffic for analysis. This requires pre-configured key logging.

    What does the Expert Info feature do?

    Expert Info highlights potential problems in captured traffic: errors (malformed packets), warnings (retransmissions, reassembly issues), notes (unusual responses), and chats (normal activity). It provides a quick assessment of network health and anomalies.

    What display filters should beginners learn first?

    Start with `http` (HTTP traffic), `dns` (DNS queries), `tcp.port == 80` (port 80 traffic), `ip.addr == 192.168.1.1` (specific host), and `http.request.method == "POST"` (POST requests). These cover most common analysis scenarios.

    What is the difference between tcpdump and Wireshark?

    tcpdump is a command-line packet capture tool ideal for remote servers and scripts. Wireshark provides a graphical interface with protocol dissection, stream following, and statistics. Use tcpdump for capture, Wireshark for detailed analysis.

    How do you capture only HTTP traffic in Wireshark?

    Use the capture filter `port 80` during capture, or the display filter `http` after capture. For HTTPS, use `tcp.port == 443` since the HTTP layer is encrypted. Combine with host filters to narrow to specific systems.

    What statistics tools does Wireshark offer?

    Wireshark provides Protocol Hierarchy (traffic breakdown), Conversations (communication pairs), Endpoints (active hosts), IO Graph (traffic over time), Flow Graph (sequence diagrams), and Expert Info (anomalies). These tools accelerate large capture analysis.