Wireshark

Wireshark is the reference network protocol analyzer: it captures and dissects traffic packet by packet. It’s essential for network forensics (Network forensics), malware/C2 analysis (Command & Control), protocol debugging, and forensics CTF challenges (see Steganography, Categories (pwn, web, crypto, forensics)).

Capture and concepts

- capture on an interface (requires permissions/promiscuous mode); or open an existing PCAP
- each packet: layers (Ethernet/IP/TCP/HTTP...), with expandable detail
- tshark is the CLI version (automate/filter at scale)

Filters (the essentials)

# DISPLAY filters (the most used ones):
ip.addr == 10.10.10.5                 # traffic to/from an IP
tcp.port == 443                        # a port
http                                   # HTTP only ; dns ; tls
http.request.method == "POST"          # POST
tcp.flags.syn == 1 && tcp.flags.ack == 0   # SYN (connection starts)
frame contains "password"              # search for a string
# CAPTURE filters (BPF, when capturing): host, port, net...

Analysis techniques

Follow Stream   reconstruct a full TCP/HTTP conversation (Follow > TCP Stream)
Statistics      Conversations, Protocol Hierarchy, Endpoints -> an overview
Export Objects  extract files transferred over HTTP/SMB (File > Export Objects)
IO Graphs       visualize volume/periodicity (useful for beaconing, see mal-c2)
Expert Info     anomalies, retransmissions, errors

Use cases

Network forensics   reconstruct what happened (dfir-red): C2, exfiltration, lateral
Malware/C2          see where a sample "calls home" (mal-c2); INetSim in a lab
Forensics CTF       extract flags/files from a PCAP (ctf-categorias)
Debugging           understand why a protocol/service fails

TLS and limits

- TLS traffic is encrypted: you only see metadata (SNI, sizes, JA3) unless you have the keys
- decrypt with SSLKEYLOGFILE (if you control the client) or session keys
- hence the value of behavioral analysis over encrypted traffic (dfir-red, crypto-tls)

Blue Team / use

Follow Stream + display filters are the day-to-day: reconstruct conversations and find the relevant.
Export Objects to extract files/payloads; IO Graphs to spot beaconing (Command & Control).
For scale/automation, tshark; for continuous detection, Zeek/Suricata (Network forensics, Network hardening).
Remember the TLS limits: without keys, only metadata (TLS).

Tips and gotchas

Use display filters (http, ip.addr==, tcp.port==) so you don’t drown; don’t confuse them with capture (BPF) filters.
“Follow TCP/HTTP Stream” and “Export Objects” reconstruct files and conversations; essential in forensics and CTF.
Common mistake: capturing unfiltered on a busy network and getting lost; capture targeted or use tshark for large volumes.
For TLS, load the SSLKEYLOGFILE if you have the keys; otherwise you only see metadata.

Testing checklist

Capture or open the PCAP; identify the conversations (Statistics)
Display filters to narrow down (ip/port/protocol/string)
Follow Stream to reconstruct key conversations
Export Objects to extract transferred files
IO Graphs to detect beaconing/periodicity (Command & Control)
Consider TLS limits (metadata only without keys)
tshark to automate at scale