Wireshark

Launch with 'sudo wireshark' from the terminal or Applications menu. Select a network interface and click the blue shark fin to start capturing. Use the display filter bar to narrow traffic — try 'http', 'ip.addr == 10.10.10.10', or 'tcp.port == 80'. Wireshark is pre-installed on Kali Linux.

Display filters narrow captured packets without re-capturing. Syntax: 'ip.addr == 10.10.10.10' for IP, 'tcp.port == 443' for port, 'http.request.method == POST' for HTTP methods, 'dns' for DNS, 'tcp.flags.syn == 1' for SYN packets. Combine with '&&' and '||' operators.

Wireshark provides a GUI for interactive deep analysis with protocol dissection and stream following. tcpdump is a lightweight CLI tool ideal for remote servers, scripts, and headless captures. Use tcpdump for quick captures and Wireshark for detailed analysis.

Right-click any packet in the stream → Follow → TCP Stream. This reconstructs the entire conversation in readable form. You can also Follow → HTTP Stream for web traffic. This is essential for reconstructing sessions, viewing transferred data, and analyzing authentication flows.

On Kali Linux, it's pre-installed. On Ubuntu/Debian: 'sudo apt install wireshark'. During installation, allow non-root users to capture when prompted. On macOS: 'brew install --cask wireshark'. On Windows, download the installer from wireshark.org.

Wireshark captures and analyzes network traffic at the packet level. It's used for network troubleshooting, security analysis, protocol debugging, forensics, and educational purposes. You can inspect every field of every packet across hundreds of protocols.

Wireshark is a network protocol analyzer used for capturing and inspecting network packets in real-time. It is used for network troubleshooting, protocol development, security analysis, and education.

Wireshark can decrypt HTTPS traffic if you have access to the SSL/TLS private keys (using SSLKEYLOGFILE) or if you configure a man-in-the-middle proxy.

Wireshark itself is legal, but using it to capture traffic on networks without authorization violates privacy laws. Always obtain permission before capturing traffic on networks you do not own.

Both capture packets, but Wireshark provides a graphical interface with protocol dissection, color coding, and advanced filtering. tcpdump is a lightweight CLI tool suitable for scripting and remote captures.

Capture filters use BPF syntax and are applied during packet capture to reduce file size. Display filters use Wireshark's own syntax and are applied after capture to narrow down the displayed packets without re-capturing.

Wireshark reads and writes PCAP and PCAPNG formats natively. It can also import captures from tcpdump, Network Monitor, and many other third-party packet capture tools and formats.

Right-click on any packet in the conversation and select Follow > TCP Stream (or UDP/HTTP Stream). This reconstructs the full payload data exchanged between the two endpoints.

Wireshark itself captures locally, but you can use SSH tunneling with remote tshark captures or the RPCAP protocol to capture packets on remote systems and analyze them in the Wireshark GUI.

Use display filters like http contains "password" or follow TCP streams to view plaintext credentials. Note that encrypted protocols like HTTPS will not reveal passwords without decryption keys.

Wireshark can handle multi-gigabyte capture files, but performance degrades with very large files. Use capture filters, ring buffers, and file size limits to manage capture size effectively.

Yes, Wireshark can capture on Wi-Fi interfaces in monitor mode to see all wireless traffic including beacon frames, probe requests, and data frames from nearby access points.

Go to File > Export Objects and select the protocol (HTTP, SMB, TFTP, etc.). Wireshark will list all transferred files that can be saved to disk for further analysis.

Coloring rules visually distinguish packet types in the packet list. Default rules color TCP in green, UDP in blue, errors in red, and retransmissions in dark purple. You can customize rules under View > Coloring Rules.

Yes, Wireshark can decode SIP signaling, reconstruct RTP audio streams, and play back VoIP calls using the Telephony menu. It supports SIP, H.323, SCCP, and IAX2 protocols.

Wireshark display filters use protocol field names like ip.src, tcp.port, or http.host. Combine them with operators (==, !=, contains, matches) and logical connectors (&&, ||, !) to build precise filter expressions.

Use SSH tunneling with remote tshark: ssh user@remote 'tshark -i eth0 -w -' > remote.pcap. Alternatively, use Wireshark's RPCAP protocol for remote capture. For Windows, use tshark on the remote machine and transfer the PCAP file. Remote captures are essential when you need to monitor traffic on systems without GUI access.

Wireshark itself does not detect intrusions, but it can identify suspicious traffic patterns like unusual ports, data exfiltration, and C2 communication through display filters. Combine with IDS/IPS tools like Snort or Suricata for automated intrusion detection. Wireshark is best for forensic analysis of captured suspicious traffic.

Use the display filter 'dns' to show all DNS traffic. For specific queries: 'dns.qry.name contains example.com'. To see DNS responses: 'dns.flags.response == 1'. For DNS tunneling detection: 'dns.qry.name.len > 50' (unusually long queries). DNS analysis helps identify covert channels, C2 communication, and DNS poisoning attacks.

Promiscuous mode allows Wireshark to capture all traffic on the local network segment by not filtering by MAC address. Monitor mode (for WiFi) captures all wireless frames including beacons, probes, and data from all nearby access points. Promiscuous mode works on wired Ethernet; monitor mode is required for wireless packet capture.

Export packets as PCAP/PCAPNG for technical evidence: File > Save As. Export as plain text: File > Export Packet Dissections > As Plain Text. Export specific packets: use display filters first, then File > Export Specified Packets. For screenshots, capture key packets showing evidence of vulnerabilities or attacks to include in your report.

Use the display filter 'arp' to show all ARP traffic. Look for duplicate IP addresses mapped to different MAC addresses, gratuitous ARP replies, and rapid ARP announcement floods. The 'arp.duplicate-address-detected' filter identifies conflicting ARP entries. Combine with 'arp.opcode == 2' to focus on ARP replies which are used in poisoning attacks.

Yes, if you have the WiFi password. Go to Edit > Preferences > Protocols > IEEE 802.11, enable decryption, and enter the WPA2 pre-shared key. Wireshark will decrypt captured WiFi traffic in real-time. For enterprise WPA2-802.1X, you need the EAP session keys from the RADIUS server.

Go to Statistics > IO Graphs to visualize traffic volume over time. Configure different display filters on separate graph lanes to compare protocols (e.g., HTTP vs DNS). Adjust the interval (1 second, 100ms) for different granularity. IO graphs help identify traffic spikes, DoS attacks, and data exfiltration patterns.

tshark is Wireshark's command-line companion: tshark -r capture.pcap -Y 'http.request' -T fields -e http.host extracts HTTP hostnames. Use -T json for structured output. Combine with scripts for automated analysis: tshark -r capture.pcap -Y 'dns.qry.name.len > 50' | wc -l counts suspicious DNS queries. tshark is ideal for CI/CD security pipelines and batch processing.

Build filters using protocol fields: ip.src==192.168.1.0/24, tcp.port==443, http.request.method==POST. Combine with logical operators: ip.src==10.0.0.1 && tcp.port==80. Use 'contains' for pattern matching: http.host contains 'example.com'. Save frequently used filters as display filter buttons via Analyze > Display Filter Macros.