Wireshark
Wireshark is an open-source packet analyzer used for network troubleshooting, protocol development, and security analysis. It captures and interactively browses traffic running on a computer network.
User interface
Conversations
tcp “conversations” (related packets) can be automatically filtered by right-clicking on a packet and selecting Conversation Filter > TCP — this matches all packets with the same source/destination IP/port.
Use Statistics > Conversations for a quick overview of conversations in a capture. Limit statistics to the current filter view with the “Limit to display filter” checkbox.
Use Statistics > Capture File Properties to view capture metadata and include/save comments.
The packet list
By default, the Time column is in seconds starting at zero for the first packet. PCAP files include full packet timestamps; change the format via View > Time Display Format.
Wireshark annotates packets with [Wireshark Data] fields:
- Stream Index — Index of streams/conversations in the current filter, starting from 0.
- TCP Segment Length — Packet data length (useful for detecting anomalies like SYN packets with data).
- Conversation Completeness — Measures how much of a conversation/stream is present (for tcp, Wireshark expects a handshake, some data, then FIN or RST).
Wireshark flags unusual tcp behaviors (e.g., missing MSS option). When an ACK packet is selected, a checkmark appears next to the packet being acknowledged.
Decryption and extraction
If an encryption key is found in a packet dump, apply it via Preferences > RSA Keys (for TLS/RSA key exchanges).
To extract files from raw tcp streams:
- Locate the beginning of the stream.
- Right-click and select Follow > TCP Stream.
- Change “Show data as” to Raw.
- Save with Save As.
Filtering
Wireshark has two filter languages: capture filters (during capture) and display filters (during viewing).
Common display filter patterns:
| Filter | Purpose |
|---|---|
!arp | Negation — hide arp packets |
tcp.flags.push == 1 | PSH flag set (interactive data, e.g. reverse shell keystrokes) |
tcp.flags.syn == 1 && tcp.flags.ack == 1 | SYN/ACK packets |
frame contains "$TEXT" | Search within packet bytes |
tcp.analysis.retransmission | Suspected retransmissions |
Click any packet field to see its filter name in the lower-left status bar. Right-click to Apply as Filter or Prepare as Filter (preview before applying).
Retransmissions
Retransmissions may be fast — transmitted before the tcp timer expires. This typically happens when SACK is used, usually after a packet isn’t acknowledged following three consecutive SACK blocks.
Customization
Profiles
Wireshark supports profiles (accessible in the lower-right status bar) — collections of settings, filters, layouts, and color rules.
Saved filters
Save filters for quick access using the + button to the right of the filter bar. Create drop-down menus by separating menu components with // (e.g., Menu//Submenu//Filter Name).
Name resolution
- Resolve transport names: Preferences > Name Resolution > Resolve transport names.
- Resolve network (IP) addresses: Preferences > Name Resolution > Resolve network (IP) addresses.
Wireshark can resolve from DNS queries in the capture itself or from an external resolver. External resolution can generate significant noise traffic.
Color rules
Color rules are filters matched in order (top-down); the first match applies. Reload the capture file after creating or modifying rules — Wireshark does not consistently apply new rules to existing captures.
Sources
Related: tcp, arp, mac-address, nmap