Wireshark Network Traffic Analysis

Purpose

Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.

Inputs / Prerequisites

Required Tools

• Wireshark installed (Windows, macOS, or Linux)

• Network interface with capture permissions

• PCAP/PCAPNG files for offline analysis

• Administrator/root privileges for live capture

Technical Requirements

• Understanding of network protocols (TCP, UDP, HTTP, DNS)

• Familiarity with IP addressing and ports

• Knowledge of OSI model layers

• Understanding of common attack patterns

Use Cases

• Network troubleshooting and connectivity issues

• Security incident investigation

• Malware traffic analysis

• Performance monitoring and optimization

• Protocol learning and education

Outputs / Deliverables

Primary Outputs

• Filtered packet captures for specific traffic

• Reconstructed communication streams

• Traffic statistics and visualizations

• Evidence documentation for incidents

Core Workflow

Phase 1: Capturing Network Traffic

Start Live Capture

Begin capturing packets on network interface:

1. Launch Wireshark
2. Select network interface from main screen
3. Click shark fin icon or double-click interface
4. Capture begins immediately

Capture Controls

Action Shortcut Description

Start/Stop Capture Ctrl+E Toggle capture on/off

Restart Capture Ctrl+R Stop and start new capture

Open PCAP File Ctrl+O Load existing capture file

Save Capture Ctrl+S Save current capture

Capture Filters

Apply filters before capture to limit data collection:

Capture only specific host

host 192.168.1.100

Capture specific port

port 80

Capture specific network

net 192.168.1.0/24

Exclude specific traffic

not arp

Combine filters

host 192.168.1.100 and port 443

Phase 2: Display Filters

Basic Filter Syntax

Filter captured packets for analysis:

IP address filters

ip.addr == 192.168.1.1 # All traffic to/from IP ip.src == 192.168.1.1 # Source IP only ip.dst == 192.168.1.1 # Destination IP only

Port filters

tcp.port == 80 # TCP port 80 udp.port == 53 # UDP port 53 tcp.dstport == 443 # Destination port 443 tcp.srcport == 22 # Source port 22

Protocol Filters

Filter by specific protocols:

Common protocols

http # HTTP traffic https or ssl or tls # Encrypted web traffic dns # DNS queries and responses ftp # FTP traffic ssh # SSH traffic icmp # Ping/ICMP traffic arp # ARP requests/responses dhcp # DHCP traffic smb or smb2 # SMB file sharing

TCP Flag Filters

Identify specific connection states:

tcp.flags.syn == 1 # SYN packets (connection attempts) tcp.flags.ack == 1 # ACK packets tcp.flags.fin == 1 # FIN packets (connection close) tcp.flags.reset == 1 # RST packets (connection reset) tcp.flags.syn == 1 && tcp.flags.ack == 0 # SYN-only (initial connection)

Content Filters

Search for specific content:

frame contains "password" # Packets containing string http.request.uri contains "login" # HTTP URIs with string tcp contains "GET" # TCP packets with string

Analysis Filters

Identify potential issues:

tcp.analysis.retransmission # TCP retransmissions tcp.analysis.duplicate_ack # Duplicate ACKs tcp.analysis.zero_window # Zero window (flow control) tcp.analysis.flags # Packets with issues dns.flags.rcode != 0 # DNS errors

Combining Filters

Use logical operators for complex queries:

AND operator

ip.addr == 192.168.1.1 && tcp.port == 80

OR operator

dns || http

NOT operator

!(arp || icmp)

Complex combinations

(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443

Phase 3: Following Streams

TCP Stream Reconstruction

View complete TCP conversation:

1. Right-click on any TCP packet
2. Select Follow > TCP Stream
3. View reconstructed conversation
4. Toggle between ASCII, Hex, Raw views
5. Filter to show only this stream

Stream Types

Stream Access Use Case

TCP Stream Follow > TCP Stream Web, file transfers, any TCP

UDP Stream Follow > UDP Stream DNS, VoIP, streaming

HTTP Stream Follow > HTTP Stream Web content, headers

TLS Stream Follow > TLS Stream Encrypted traffic (if keys available)

Stream Analysis Tips

• Review request/response pairs

• Identify transmitted files or data

• Look for credentials in plaintext

• Note unusual patterns or commands

Phase 4: Statistical Analysis

Protocol Hierarchy

View protocol distribution:

Statistics > Protocol Hierarchy

Shows:

• Percentage of each protocol
• Packet counts
• Bytes transferred
• Protocol breakdown tree

Conversations

Analyze communication pairs:

Statistics > Conversations

Tabs:

• Ethernet: MAC address pairs
• IPv4/IPv6: IP address pairs
• TCP: Connection details (ports, bytes, packets)
• UDP: Datagram exchanges

Endpoints

View active network participants:

Statistics > Endpoints

Shows:

• All source/destination addresses
• Packet and byte counts
• Geographic information (if enabled)

Flow Graph

Visualize packet sequence:

Statistics > Flow Graph

Options:

• All packets or displayed only
• Standard or TCP flow
• Shows packet timing and direction

I/O Graphs

Plot traffic over time:

Statistics > I/O Graph

Features:

• Packets per second
• Bytes per second
• Custom filter graphs
• Multiple graph overlays

Phase 5: Security Analysis

Detect Port Scanning

Identify reconnaissance activity:

SYN scan detection (many ports, same source)

ip.src == SUSPECT_IP && tcp.flags.syn == 1

Review Statistics > Conversations for anomalies

Look for single source hitting many destination ports

Identify Suspicious Traffic

Filter for anomalies:

Traffic to unusual ports

tcp.dstport > 1024 && tcp.dstport < 49152

Traffic outside trusted network

!(ip.addr == 192.168.1.0/24)

Unusual DNS queries

dns.qry.name contains "suspicious-domain"

Large data transfers

frame.len > 1400

ARP Spoofing Detection

Identify ARP attacks:

Duplicate ARP responses

arp.duplicate-address-frame

ARP traffic analysis

arp

Look for:

- Multiple MACs for same IP

- Gratuitous ARP floods

- Unusual ARP patterns

Examine Downloads

Analyze file transfers:

HTTP file downloads

http.request.method == "GET" && http contains "Content-Disposition"

Follow HTTP Stream to view file content

Use File > Export Objects > HTTP to extract files

DNS Analysis

Investigate DNS activity:

All DNS traffic

dns

DNS queries only

dns.flags.response == 0

DNS responses only

dns.flags.response == 1

Failed DNS lookups

dns.flags.rcode != 0

Specific domain queries

dns.qry.name contains "domain.com"

Phase 6: Expert Information

Access Expert Analysis

View Wireshark's automated findings:

Analyze > Expert Information

Categories:

• Errors: Critical issues
• Warnings: Potential problems
• Notes: Informational items
• Chats: Normal conversation events

Common Expert Findings

Finding Meaning Action

TCP Retransmission Packet resent Check for packet loss

Duplicate ACK Possible loss Investigate network path

Zero Window Buffer full Check receiver performance

RST Connection reset Check for blocks/errors

Out-of-Order Packets reordered Usually normal, excessive is issue

Quick Reference

Keyboard Shortcuts

Action Shortcut

Open file Ctrl+O

Save file Ctrl+S

Start/Stop capture Ctrl+E

Find packet Ctrl+F

Go to packet Ctrl+G

Next packet ↓

Previous packet ↑

First packet Ctrl+Home

Last packet Ctrl+End

Apply filter Enter

Clear filter Ctrl+Shift+X

Common Filter Reference

Web traffic

http || https

Email

smtp || pop || imap

File sharing

smb || smb2 || ftp

Authentication

ldap || kerberos

Network management

snmp || icmp

Encrypted

tls || ssl

Export Options

File > Export Specified Packets # Save filtered subset File > Export Objects > HTTP # Extract HTTP files File > Export Packet Dissections # Export as text/CSV

Constraints and Guardrails

Operational Boundaries

• Capture only authorized network traffic

• Handle captured data according to privacy policies

• Avoid capturing sensitive credentials unnecessarily

• Properly secure PCAP files containing sensitive data

Technical Limitations

• Large captures consume significant memory

• Encrypted traffic content not visible without keys

• High-speed networks may drop packets

• Some protocols require plugins for full decoding

Best Practices

• Use capture filters to limit data collection

• Save captures regularly during long sessions

• Use display filters rather than deleting packets

• Document analysis findings and methodology

Examples

Example 1: HTTP Credential Analysis

Scenario: Investigate potential plaintext credential transmission

1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters

Finding: Credentials transmitted in cleartext form data.

Example 2: Malware C2 Detection

Scenario: Identify command and control traffic

1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns

Indicators:

• Regular timing intervals

• Encoded/encrypted payloads

• Unusual ports or protocols

Example 3: Network Troubleshooting

Scenario: Diagnose slow web application

1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss

Finding: TCP retransmissions indicating network congestion.

Troubleshooting

No Packets Captured

• Verify correct interface selected

• Check for admin/root permissions

• Confirm network adapter is active

• Disable promiscuous mode if issues persist

Filter Not Working

• Verify filter syntax (red = error)

• Check for typos in field names

• Use Expression button for valid fields

• Clear filter and rebuild incrementally

Performance Issues

• Use capture filters to limit traffic

• Split large captures into smaller files

• Disable name resolution during capture

• Close unnecessary protocol dissectors

Cannot Decrypt TLS/SSL

• Obtain server private key

• Configure at Edit > Preferences > Protocols > TLS

• For ephemeral keys, capture pre-master secret from browser

• Some modern ciphers cannot be decrypted passively