SEC: Wireshark — GUI Packet Capture and Protocol Analysis

What is Wireshark?

Wireshark is one of the most potent traffic analyzer tools available. It provides a full graphical interface for capturing, dissecting, filtering, and analyzing network packets at the protocol level.

Primary uses:

• Detecting and troubleshooting network problems such as load failures and congestion
• Detecting security anomalies such as rogue hosts, abnormal port usage, and suspicious traffic
• Investigating and learning protocol details including response codes and payload data

Interface Layout

The Wireshark GUI opens with a single all-in-one page containing five main sections:

Opening PCAP Files

Load a saved packet capture using:

• File menu → Open
• Drag and drop the .pcap file into the window
• Double-click the file in the file manager

Once loaded, three panes appear:

To see capture metadata (file size, duration, packet count): Statistics → Capture File Properties or click the pcap icon in the bottom-left corner.

Traffic Sniffing (Live Capture)

• Click the shark fin button to start capturing network traffic
• Click the red square button to stop the capture
• Click the green arrow button to restart the capture

The status bar displays the active sniffing interface and the number of collected packets in real time.

Packet Dissection

Packet dissection (also called protocol dissection) decodes available protocols and fields within each captured packet. Wireshark supports an extensive list of protocols.

Every packet follows the OSI model layers:

Packet Structure in Wireshark:
├── Layer 1: Frame (physical layer timing, interface)
├── Layer 2: Ethernet (source MAC, destination MAC)
├── Layer 3: IP (source IP, destination IP, TTL)
├── Layer 4: TCP/UDP (ports, flags, sequence numbers)
├── Layer 5–7: Application Protocol (HTTP, DNS, FTP, etc.)
└── Application Data (payload content)

Clicking any layer in the Packet Details pane highlights the corresponding bytes in the Packet Bytes pane.

Packet Navigation

Wireshark assigns a unique sequential number to each captured packet.

Navigating packets:

• Go menu → Go to Packet — jump directly to a specific packet number
• Click any packet in the Packet List pane to select it

Finding specific packets:

• Edit menu → Find Packet
• Search within: Packet List, Packet Details, or Packet Bytes pane
• Input types supported: String, Regex, Hex, or Display Filter
• Optional: case-sensitive checkbox

Time Display Format

By default, Wireshark shows time as "Seconds Since Beginning of Capture." For security investigations and log correlation, UTC time is usually more useful.

Change via: View → Time Display Format → UTC Date and Time of Day

Expert Information

Analyze → Expert Information shows Wireshark's automated detection of protocol anomalies and states:

• Errors (connection resets, malformed packets)
• Warnings (retransmissions, duplicate ACKs)
• Notes (protocol-specific state information)
• Chats (normal session events)

These are suggestions only — always verify findings manually. Expert information can produce both false positives and false negatives.

Packet Filtering

Wireshark provides two distinct filtering mechanisms:

Capture Filters

Applied before capturing — only packets matching the filter are captured. Uses BPF (Berkeley Packet Filter) syntax (same as tcpdump).

# BPF examples for capture filters:
host 192.168.1.1
port 80
tcp port 443
not arp

Display Filters

Applied after capturing — show only packets matching the filter from an existing capture. Uses Wireshark's own display filter syntax.

# Display filter examples:
http                          # Only HTTP packets
tcp.port == 80                # TCP port 80
ip.src == 192.168.1.10        # From specific IP
ip.dst == 10.0.0.1            # To specific IP
dns                           # DNS traffic
tcp.flags.syn == 1            # SYN packets
http.request.method == "POST" # HTTP POST requests

Filter Application Methods

Apply as Filter:

• Right-click any field in Packet Details → Apply as Filter
• Or use Analyze → Apply as Filter
• Immediately applies the filter for that field's value

Prepare as Filter:

• Similar to Apply as Filter, but adds the query to the filter bar without executing — allows adding and/or conditions before applying

Conversation Filter:

• Right-click a packet → Conversation Filter
• Shows only packets belonging to the same conversation (TCP stream, UDP exchange, etc.)

Apply as Column:

• Right-click a field → Apply as Column
• Adds the field as a visible column in the Packet List pane

Follow Stream

Wireshark reassembles protocol streams so you can view the complete conversation at the application layer.

• Right-click a packet → Follow → TCP Stream (or UDP, HTTP, TLS)
• Opens a dialog showing the full reconstructed conversation
• Sent data appears in red, received data in blue

This is particularly useful for:

• Reading complete HTTP conversations
• Viewing FTP command sequences
• Extracting files transferred over HTTP or FTP
• Seeing credential exchanges in cleartext protocols

Exporting Data

File → Export Options:

The Export Objects feature is particularly powerful for incident response — it can reconstruct files that were transferred over the network during a capture.

Common Security Analysis Workflows

Detecting Cleartext Credentials

# Display filter for HTTP basic auth or form data
http.request.method == "POST"
# Then follow the TCP stream to see credentials

Finding SYN Flood Patterns

# Filter for TCP SYN packets (potential flood)
tcp.flags.syn == 1 and tcp.flags.ack == 0
# High count from diverse IPs = potential SYN flood

DNS Analysis

# Filter DNS queries and responses
dns
# Look for unusual domains, high query rates, or long TXT records (DNS tunneling)

ARP Poisoning Detection

# Filter ARP traffic
arp
# Look for multiple ARP replies for the same IP with different MACs