Packet analysis with Wireshark
Why it matters: Reading traffic helps you understand protocols, spot suspicious activity and answer network-data questions. Your guide covers packet captures only briefly (p.322).
Overview
Supplementary — not from your PDFWireshark captures and decodes network traffic. Analysts use display filters to cut a large capture down to the conversations that matter, then read protocol details.
Useful display filters
| Filter | Shows |
|---|---|
ip.addr == 192.168.56.10 | Traffic to or from one host |
tcp.port == 443 | One TCP port |
dns | DNS queries and responses |
http.request | Unencrypted HTTP requests |
tls.handshake.type == 1 | TLS Client Hello (look for the SNI) |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | New TCP connection attempts |
icmp | Pings and ICMP errors |
!(arp || dns) | Hide background noise |
What to look for
- Unencrypted credentials or data in HTTP, FTP or Telnet: a reason to switch to secure protocols.
- Unusual DNS: very long or random-looking names, or lots of lookups to one new domain.
- Many connection attempts from one host to many ports or hosts, which suggests scanning.
- Traffic at odd times, or to destinations your organization doesn't normally talk to.
- Capture filters (set before capturing) limit what's saved. Display filters (after) only change what you see.