arsenal/wireshark

wireshark

packet analysis · GPLv2

The reference packet analyzer: capture traffic and dissect it frame by frame, with the deepest protocol decoding of any tool.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01What wireshark is for

Wireshark shows you exactly what crossed the wire, one frame at a time, decoded from Ethernet up through the application layer. When something on the network does not behave, when you need to prove what a device actually sent, or when you want to understand a protocol by watching it, wireshark is the microscope. It captures live or opens a saved file; the skill is not capturing, it is filtering down to the few frames that matter.

↑ contents

02Install and capture permissions

During install you are asked whether non-root users may capture; saying yes adds the dumpcap capability so you do not run the whole GUI as root, which is the safer setup. Add yourself to the wireshark group to use it.

$ sudo emerge net-analyzer/wireshark # Gentoo

$ sudo apt install wireshark # Debian / Ubuntu / Kali

$ sudo dnf install wireshark # Fedora / RHEL

$ sudo usermod -aG wireshark $USER # capture without root (re-login after)

03Choosing an interface

Pick the interface carrying the traffic you care about. On wifi, capturing in monitor mode shows other devices' frames; on a switch, you only see your own traffic and broadcasts unless you set up a port mirror or tap. That last point surprises people: a switch is not a hub, so plugging in and expecting to see everything does not work.

» No traffic from other hosts on a wired network usually means the switch is doing its job. You need a SPAN/mirror port or a tap to see it.

04Long captures without filling the disk

For a capture you will leave running, use a ring buffer so wireshark rolls into new files and discards the oldest, rather than growing one file until the disk fills. This is a tshark job as much as a GUI one.

$ tshark -i eth0 -b filesize:51200 -b files:10 -w rolling.pcapng

↑ contents

05Display filters

The single most important skill in wireshark is the display filter: the expression bar that hides everything except the frames you want. It is a rich language, and a handful of expressions covers most work. These filter what you see, not what was captured.

$ ip.addr == 10.0.0.12

$ tcp.port == 443

$ http.request.method == "POST"

$ dns && !dns.flags.response == 1

$ tcp.flags.syn == 1 && tcp.flags.ack == 0

06Capture filters versus display filters

There are two filter languages and people mix them up. Capture filters (BPF syntax, set before you start) decide what is written to disk and cannot be undone afterwards. Display filters (wireshark syntax, set anytime) decide what you see from what was captured. Use a capture filter to keep a long capture small; use display filters to explore.

$ # capture filter (BPF), set before capturing:

$ host 10.0.0.12 and port 443

$ # display filter (wireshark), applied to the loaded capture:

$ ip.addr == 10.0.0.12 && tls

07Follow a stream

Right-click a packet and Follow > TCP Stream to reassemble an entire conversation into one readable view, request and response together. This is how you read an unencrypted HTTP exchange, an FTP session, or any text protocol as it actually happened, instead of frame by frame.

08Finding secrets in the clear

The uncomfortable lesson wireshark teaches is how much still travels unencrypted. Plain HTTP form posts, FTP, Telnet, and old mail protocols carry credentials in cleartext that a capture reveals instantly. On your own network this is the argument for TLS everywhere, made visible.

$ http.request.method == "POST"

$ ftp.request.command == "PASS"

$ telnet

» If you can read a password in your own capture, so can anyone else on that network segment. That is the finding; the fix is encryption.

↑ contents

09tshark for the terminal and scripts

tshark is wireshark's command-line form, which matters on a headless box and for scripting. It takes the same display filters and can print just the fields you want, which turns a capture into data you can pipe and count.

$ tshark -r capture.pcapng -Y "http.request" -T fields -e ip.src -e http.host -e http.request.uri

10Wireshark as a defender's instrument

Most of your wireshark time should be spent on your own network, answering defensive questions. Is this device phoning home somewhere it should not? Why is the link saturated? Is that really TLS or something pretending to be? Packet truth settles arguments that logs cannot. Pair it with the captures from tcpdump on remote boxes (next guide), which you then open here.

Keep captures to networks you run. Analysing traffic you were not authorized to capture does not become acceptable because the tool is a standard one.

↑ contents