Quick Answer: What Is Wireshark?

Featured Snippet Answers

Short, extractable answers written to be quoted directly by Google, ChatGPT, Gemini, Claude, Perplexity, and Copilot.

1 · What Is Wireshark?

Wireshark puts raw network traffic under a microscope. It captures frames from a network interface (or reads them from a saved file), then decodes each frame through protocol dissectors — turning opaque bytes into readable trees: Ethernet → IP → TCP → HTTP → payload. The result is the definitive answer to “what is actually happening on my network?”

Key facts: first released in 1998 as Ethereal by Gerald Combs; renamed to Wireshark in 2006. It is GPL-licensed, runs on Windows, Linux, and macOS, and reads/writes more than 30 capture formats (pcap, pcapng, and others) so it can analyze files produced by tcpdump, Npcap, Wireshark itself, and many appliances.

2 · Why Use Wireshark?

3 · Who Should Learn Wireshark?

4 · Features of Wireshark

• Live capture and offline analysis — capture directly or open saved pcap/pcapng files.
• Deep protocol inspection — 2,000+ dissectors across Ethernet, IP, TCP/UDP, and applications.
• Capture filters (BPF) — limit what gets recorded, reducing file size and noise.
• Display filters — a full field-based language with autocomplete, comparison, and regex operators.
• Coloring rules — color-code traffic by protocol, error, or conversation for instant scanning.
• Follow Stream — rebuild TCP/UDP/TLS streams as readable conversation views.
• Export Objects — extract files (images, documents, executables) transferred over HTTP/SMB.
• Statistics — protocol hierarchy, conversations, endpoints, IO graphs, and service-response times.
• Expert Info — automatic detection of retransmissions, duplicate ACKs, and other anomalies.
• TShark CLI — the same engine without the GUI, for scripts and servers.
• Lua scripting — custom dissectors, taps, and automation.
• Decryption support — TLS key-log files and IPsec keys for authorized analysis.

5 · Installing Wireshark

Windows

1. Download the 64-bit installer from wireshark.org/download.html.
2. Run the installer. When prompted, install Npcap — the capture driver Wireshark depends on. Keep “Start Npcap Service at boot” checked.
3. Optionally check “Add Wireshark to PATH” for CLI tools like tshark and capinfos.

Linux

sudo apt update && sudo apt install -y wireshark
# when asked about non-superuser capture, choose Yes
sudo usermod -aG wireshark $USER
# log out and back in for the group to take effect

sudo dnf install -y wireshark-cli wireshark

macOS

brew install --cask wireshark

Verify the Installation

wireshark --version
tshark --version
tshark -D          # list capture interfaces

Installation Troubleshooting

6 · Understanding the Interface

Wireshark’s main window is built around three panes, all driven by a single selected packet:

1. Packet List pane (top): one row per packet — number, time, source, destination, protocol, length, and info. Click a row to inspect it.
2. Packet Details pane (middle): the decoded protocol tree: Frame → Ethernet → IP → TCP → application. Expand any field; field names here are the basis of display filters.
3. Packet Bytes pane (bottom): the raw packet in hex and ASCII. Clicking bytes highlights the corresponding decoded field.

Key interface elements: the filter toolbar (with a green/red background indicating valid/invalid display filters), the main toolbar (start/stop capture, open/save), the status bar (capture stats), and Expert Info (the color-coded warning icon in the status bar). Coloring rules tint packets (e.g., black = TCP problems, red = bad TCP) so anomalies jump out visually.

7 · Capture Filters (BPF Syntax)

Capture filters run inside the capture driver and discard non-matching packets before they reach Wireshark. They use Berkeley Packet Filter (BPF) syntax — the same language as tcpdump. Use them to control volume; use display filters for analysis.

8 · Display Filters (Field-Based Syntax)

Display filters operate on already-captured packets and only change what you see — nothing is deleted. They reference protocol fields by name (exactly as shown in the Packet Details pane) and support comparison, logical, and regex operators.

Operators

Essential Display Filters

9 · TCP Analysis

TCP is the protocol you will analyze most. Start with the three-way handshake, then learn to read the analysis flags Wireshark computes automatically.

The Three-Way Handshake in Wireshark

tcp.flags.syn == 1

Look for the [SYN], [SYN, ACK], [ACK] sequence in the Info column. A [RST, ACK] instead of [SYN, ACK] means the port is closed; silence means filtered.

TCP Analysis Flags (Expert Info)

10 · UDP Analysis

UDP is connectionless — no handshake, no sequence numbers, no retransmissions. Analysis is simpler: source/destination port, length, and payload. Wireshark still flags anomalies where it can (e.g., IP fragmentation, checksum errors).

Common UDP issues: packet loss is invisible to the protocol itself (applications detect it), and firewalls often drop UDP silently. When a UDP service “doesn’t work”, Wireshark answers the first question: did the request even leave the client, and did any response come back?

11 · DNS Analysis

DNS maps names to addresses and is involved in nearly every connection — which makes it a goldmine for troubleshooting and security analysis (C2 domains, DNS tunneling, phishing).

Statistics → DNS → display the query-name table

Troubleshooting pattern: query sent but no response → DNS server unreachable or UDP 53 blocked; NXDOMAIN → name genuinely doesn’t exist (typo or missing record); SERVFAIL → server-side problem; wrong IP returned → stale cache or DNS hijacking.

12 · HTTP & HTTPS Analysis

HTTP is the easiest protocol to read in Wireshark — requests and responses are human-readable, and the analysis tools are excellent.

HTTP Display Filters

Follow Stream & Export Objects

Right-click any HTTP packet → Follow → TCP Stream

File → Export Objects → HTTP → select files → Save

HTTPS: TLS encrypts the payload, so you see the handshake and metadata (Server Name Indication, certificates, cipher suites) but not the content — unless you supply decryption keys (see the TLS section). For web-app testing of decrypted traffic, pair Wireshark with Burp Suite: configure Burp as the proxy and capture from Wireshark at the same time.

13 · ICMP Analysis

ICMP carries ping (echo), errors, and path information. It is the first protocol to check when a host “isn’t reachable”.

Troubleshooting pattern: requests sent but no replies → firewall blocks ICMP or host is down; replies with long RTT → latency; Destination unreachable (Port unreachable) → a UDP port is closed (useful cross-check for Nmap UDP results); Time exceeded → TTL too small or routing loop.

14 · ARP Analysis

ARP maps IPv4 addresses to MAC addresses on local networks. It is broadcast-based, unauthenticated — and therefore a favorite target for attackers (ARP spoofing/poisoning).

Security pattern — ARP spoofing: one IP address answered by many different MACs over time, or a flood of gratuitous ARP replies, indicates poisoning. In a lab, run arpspoof (from dsniff) and watch the victim’s ARP cache change — then examine the same evidence in Wireshark to learn what the attack looks like on the wire.

15 · DHCP Analysis

DHCP (Dynamic Host Configuration Protocol) assigns IP configuration automatically. The DORA exchange — Discover, Offer, Request, Acknowledge — is easy to follow in Wireshark.

Troubleshooting pattern: Discover sent but no Offer → no reachable DHCP server (check VLANs/relays); repeated Requests → lease conflicts or server misconfiguration; a rogue DHCP server is identifiable because two servers answer with different Offers — filter by dhcp.option.dhcp == 2 and inspect the sender IPs.

16 · SSL/TLS Analysis

TLS secures HTTPS, SMTP, IMAP, and most modern APIs. In Wireshark you can see the handshake, cipher suites, certificates, and SNI — and with key material, decrypt the session (authorized analysis only).

TLS Handshake & Metadata Filters

Decrypting TLS with a Key Log File (Authorized Analysis)

1. Set the environment variable SSLKEYLOGFILE=/path/keys.log before launching the browser or application you want to decrypt (Firefox and Chrome both support it).
2. In Wireshark: Edit → Preferences → Protocols → TLS → set (Pre)-Master-Secret log filename to that file.
3. Capture (or open the pcap) and Wireshark decrypts the sessions recorded in the log.

17 · Malware Traffic Analysis

Malware must communicate: with a C2 server, to exfiltrate data, or to scan the network. That communication is evidence. A structured hunt turns a pcap into indicators.

The A7 Malware-Traffic Hunt Checklist

1. Start with the outliers: tcp.analysis.flags or dns.flags.rcode == 3 — errors and failed lookups point to beaconing and dead C2s.
2. List every DNS name: Statistics → DNS. Look for long random subdomains, new domains, or patterns matching a regex.
3. Find unusual ports: tcp.port in {4444,5555,8080,9001} then Statistics → Endpoints to see uncommon pairs.
4. Follow suspicious streams: right-click → Follow TCP Stream; look for binary blobs, encoded commands, or IRC-like chatter.
5. Extract files: File → Export Objects (HTTP, SMB, TFTP) — then hash them and check VirusTotal.
6. Check for common C2 strings: frame contains "cmd", http.request.uri contains "shell", frame contains "powershell".
7. Geo-locate: enable MaxMind GeoIP (Preferences → Name Resolution) to see where endpoints resolve.
8. Document: screenshot each finding with its filter string, timestamp, and IPs.

18 · Troubleshooting Networks with Wireshark

A systematic method beats random clicking. For every “the network is slow” report, run this sequence:

1. Capture at the right point — on the affected client, with a capture filter (host <server>) to keep the file small.
2. Check Expert Info — Analyze → Expert Info; fix the errors first, then look at warnings.
3. Quantify retransmissions — filter tcp.analysis.retransmission; count them and check the IO Graph for the rate over time.
4. Measure latency — filter tcp.analysis.ack_rtt to see per-segment round-trip times.
5. Check the window — tcp.analysis.zero_window tells you if the receiver is the bottleneck.
6. Confirm the handshake — tcp.flags.syn == 1: if SYN gets no SYN-ACK, the server or a firewall is dropping it.
7. Document — save a filtered view (File → Export Specified Packets) and a screenshot with the filter string visible.

19 · Common Errors and How to Fix Them

20 · Best Practices for Packet Analysis

21 · Wireshark vs tcpdump (and TShark)

When to use which: tcpdump is the right tool on a headless server or embedded device (tcpdump -i eth0 -w capture.pcap); Wireshark is the right tool for deep analysis afterward. TShark bridges both — capture with tcpdump, analyze with tshark -r, and open the same file in the GUI when you need visuals.

tcpdump -i eth0 -w capture.pcap "tcp port 443"   # capture
tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions.server_name

22 · Wireshark Cheat Sheet (Top 50 Quick Filters)

Hands-On Lab Tutorials (Traffic You Generate Yourself)

These labs capture only traffic between your own machines or your own web requests — no production network is touched. Run them on a laptop, a lab VM, or a home router you administer.

Lab 1 — Capture and Read Your Own Web Traffic

1. Start a capture on your active interface with capture filter tcp port 80 or tcp port 443.
2. Open http://example.com in a browser, wait 5 seconds, then stop the capture.
3. Apply http and inspect a GET request: expand HTTP → find User-Agent, Host, and the request URI.
4. Right-click a request → Follow TCP Stream and read the full exchange.
5. Note what you cannot see in the HTTPS requests (TLS Application Data) — then redo the lab with SSLKEYLOGFILE to decrypt your own traffic.

Lab 2 — DNS Query Analysis

1. Capture with filter udp port 53.
2. Run nslookup example.com and nslookup nonexistent-domain-xyz.example.
3. Filter dns.flags.response == 1: find the A record in the first answer, and the rcode 3 (NXDOMAIN) in the second.
4. Use Statistics → DNS to see the full query table.

Lab 3 — ARP and DHCP in One Capture

1. On a machine connected to a DHCP network, capture with dhcp or arp.
2. Run ipconfig /release then ipconfig /renew (Windows) or restart the network service (Linux).
3. Watch the DORA exchange with dhcp.option.dhcp, then arp to see who-asks-who on the local segment.

Lab 4 — Diagnose a Slow Download

1. Capture with tcp port 443 while downloading a large file from your own server (or a test file you control).
2. Apply tcp.analysis.retransmission and count events; then tcp.analysis.ack_rtt for latency.
3. Open Statistics → IO Graph with a “TCP retransmissions” filter layer to visualize loss over time.

Case Study (Training Lab Example)

The A7 Packet Analysis Framework

Our training method for turning raw captures into conclusions — the same discipline we teach SOC analysts:

Expert Commentary: A7 Security Hunters’ Perspective

Research & Industry Context (Verified 2025 Figures)

Packet analysis sits at the heart of detection and response — and the data confirms why visibility matters more every year.

What this means for analysts: credential abuse and vulnerability exploitation both leave packet-level traces — authentication bursts, C2 beacons, and scanning patterns. Capturing, filtering, and correlating those traces is precisely what Wireshark-based workflows do, and it is a direct input to the automation that IBM found saves an average of $1.9M per breach.

50 Frequently Asked Questions

Related Guides from A7 Security Hunters

Packet analysis completes the core toolset. Continue building your skills with the rest of the cluster:

References & Authoritative Sources