This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.
Inputs / Prerequisites
Required Tools
Wireshark installed (Windows, macOS, or Linux)
Network interface with capture permissions
PCAP/PCAPNG files for offline analysis
Administrator/root privileges for live capture
Technical Requirements
Understanding of network protocols (TCP, UDP, HTTP, DNS)
Familiarity with IP addressing and ports
Knowledge of OSI model layers
Understanding of common attack patterns
Use Cases
Network troubleshooting and connectivity issues
Security incident investigation
Malware traffic analysis
Performance monitoring and optimization
Protocol learning and education
Outputs / Deliverables
Primary Outputs
Filtered packet captures for specific traffic
Reconstructed communication streams
Traffic statistics and visualizations
Evidence documentation for incidents
Core Workflow
Phase 1: Capturing Network Traffic
Start Live Capture
Begin capturing packets on network interface:
1. Launch Wireshark
2. Select network interface from main screen
3. Click shark fin icon or double-click interface
4. Capture begins immediately
Capture Controls
Action
Shortcut
Description
Start/Stop Capture
Ctrl+E
Toggle capture on/off
Restart Capture
Ctrl+R
Stop and start new capture
Open PCAP File
Ctrl+O
Load existing capture file
Save Capture
Ctrl+S
Save current capture
Capture Filters
Apply filters before capture to limit data collection:
# Capture only specific host
host 192.168.1.100
# Capture specific port
port 80
# Capture specific network
net 192.168.1.0/24
# Exclude specific traffic
not arp
# Combine filters
host 192.168.1.100 and port 443
Phase 2: Display Filters
Basic Filter Syntax
Filter captured packets for analysis:
# IP address filters
ip.addr == 192.168.1.1 # All traffic to/from IP
ip.src == 192.168.1.1 # Source IP only
ip.dst == 192.168.1.1 # Destination IP only
# Port filters
tcp.port == 80 # TCP port 80
udp.port == 53 # UDP port 53
tcp.dstport == 443 # Destination port 443
tcp.srcport == 22 # Source port 22
Protocol Filters
Filter by specific protocols:
# Common protocols
http # HTTP traffic
https or ssl or tls # Encrypted web traffic
dns # DNS queries and responses
ftp # FTP traffic
ssh # SSH traffic
icmp # Ping/ICMP traffic
arp # ARP requests/responses
dhcp # DHCP traffic
smb or smb2 # SMB file sharing
tcp.analysis.retransmission # TCP retransmissions
tcp.analysis.duplicate_ack # Duplicate ACKs
tcp.analysis.zero_window # Zero window (flow control)
tcp.analysis.flags # Packets with issues
dns.flags.rcode != 0 # DNS errors
Combining Filters
Use logical operators for complex queries:
# AND operator
ip.addr == 192.168.1.1 && tcp.port == 80
# OR operator
dns || http
# NOT operator
!(arp || icmp)
# Complex combinations
(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443
Phase 3: Following Streams
TCP Stream Reconstruction
View complete TCP conversation:
1. Right-click on any TCP packet
2. Select Follow > TCP Stream
3. View reconstructed conversation
4. Toggle between ASCII, Hex, Raw views
5. Filter to show only this stream
Stream Types
Stream
Access
Use Case
TCP Stream
Follow > TCP Stream
Web, file transfers, any TCP
UDP Stream
Follow > UDP Stream
DNS, VoIP, streaming
HTTP Stream
Follow > HTTP Stream
Web content, headers
TLS Stream
Follow > TLS Stream
Encrypted traffic (if keys available)
Stream Analysis Tips
Review request/response pairs
Identify transmitted files or data
Look for credentials in plaintext
Note unusual patterns or commands
Phase 4: Statistical Analysis
Protocol Hierarchy
View protocol distribution:
Statistics > Protocol Hierarchy
Shows:
- Percentage of each protocol
- Packet counts
- Bytes transferred
- Protocol breakdown tree
Statistics > Endpoints
Shows:
- All source/destination addresses
- Packet and byte counts
- Geographic information (if enabled)
Flow Graph
Visualize packet sequence:
Statistics > Flow Graph
Options:
- All packets or displayed only
- Standard or TCP flow
- Shows packet timing and direction
I/O Graphs
Plot traffic over time:
Statistics > I/O Graph
Features:
- Packets per second
- Bytes per second
- Custom filter graphs
- Multiple graph overlays
Phase 5: Security Analysis
Detect Port Scanning
Identify reconnaissance activity:
# SYN scan detection (many ports, same source)
ip.src == SUSPECT_IP && tcp.flags.syn == 1
# Review Statistics > Conversations for anomalies
# Look for single source hitting many destination ports
Identify Suspicious Traffic
Filter for anomalies:
# Traffic to unusual ports
tcp.dstport > 1024 && tcp.dstport < 49152
# Traffic outside trusted network
!(ip.addr == 192.168.1.0/24)
# Unusual DNS queries
dns.qry.name contains "suspicious-domain"
# Large data transfers
frame.len > 1400
ARP Spoofing Detection
Identify ARP attacks:
# Duplicate ARP responses
arp.duplicate-address-frame
# ARP traffic analysis
arp
# Look for:
# - Multiple MACs for same IP
# - Gratuitous ARP floods
# - Unusual ARP patterns
Examine Downloads
Analyze file transfers:
# HTTP file downloads
http.request.method == "GET" && http contains "Content-Disposition"
# Follow HTTP Stream to view file content
# Use File > Export Objects > HTTP to extract files
DNS Analysis
Investigate DNS activity:
# All DNS traffic
dns
# DNS queries only
dns.flags.response == 0
# DNS responses only
dns.flags.response == 1
# Failed DNS lookups
dns.flags.rcode != 0
# Specific domain queries
dns.qry.name contains "domain.com"
1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters
Finding: Credentials transmitted in cleartext form data.
Example 2: Malware C2 Detection
Scenario: Identify command and control traffic
1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns
Indicators:
Regular timing intervals
Encoded/encrypted payloads
Unusual ports or protocols
Example 3: Network Troubleshooting
Scenario: Diagnose slow web application
1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss
