Wireshark: The Complete Guide to Network Protocol Analysis

Introduction to Wireshark

Wireshark is the world’s foremost network protocol analyzer and an essential tool for any network administrator, security professional, or IT enthusiast. Originally known as Ethereal, this open-source software allows you to examine data from a live network or from a capture file on disk. You can interactively browse the captured data, delving into the details of network packets.

With Wireshark, you can:

• Inspect hundreds of protocols, with more being added all the time
• Capture live packet data from a network interface
• Display packets with very detailed protocol information
• Save packet data captured
• Import and export packet data from and to many other capture programs
• Filter packets on many criteria
• Search for packets on many criteria
• Colorize packet display based on filters
• Create various statistics

Installation Guide

Wireshark is available for Windows, macOS, and various Linux distributions. The installation process varies slightly depending on your operating system.

Windows Installation

For Windows users, the installation process is straightforward:

1. Visit the official Wireshark download page
2. Download the Windows installer (.exe file)
3. Run the installer with administrator privileges
4. Follow the installation wizard, accepting the license agreement and choosing components
5. When prompted, install WinPcap or Npcap (packet capture drivers)
6. Complete the installation and launch Wireshark

macOS Installation

For macOS users:

1. Download the macOS installer (.dmg file) from the official website
2. Open the .dmg file and drag the Wireshark icon to your Applications folder
3. When you first launch Wireshark, you may need to install additional components like ChmodBPF

Linux Installation

For Linux distributions, you can install Wireshark using your package manager:

# For Debian/Ubuntu-based systems
sudo apt update
sudo apt install wireshark

# For Red Hat/Fedora-based systems
sudo dnf install wireshark

After installation, you’ll need to add your user to the ‘wireshark’ group to capture packets without root privileges:

sudo usermod -a -G wireshark $USER

Understanding the Interface

Wireshark’s interface might seem overwhelming at first, but once you understand its components, it becomes intuitive and powerful. Let’s break down the main elements:

Main Window Components

The Wireshark interface consists of several key areas:

• Menu and Toolbar: Contains all commands and options
• Packet List Pane: Displays all captured packets in a summary line format
• Packet Details Pane: Shows the protocols and protocol fields of the selected packet in a tree view
• Packet Bytes Pane: Displays the raw data of the selected packet in a hexadecimal view
• Status Bar: Shows information about the current capture or loaded file

Color Coding

Wireshark uses color coding to help you quickly identify different types of traffic:

• Light green – TCP traffic
• Light blue – UDP traffic
• Light red – Errors
• Yellow – Name resolution (DNS)
• Light purple – HTTP traffic

You can customize these colors or create your own coloring rules based on specific criteria under View > Coloring Rules.

Capturing Network Traffic

Capturing packets is Wireshark’s primary function. Here’s how to get started with your first packet capture:

Starting a Capture

1. Launch Wireshark
2. In the welcome screen, you’ll see a list of available network interfaces
3. Hover over an interface to see a real-time graph of its traffic
4. Click on an interface to start capturing packets from it immediately
5. Alternatively, double-click an interface to open the “Capture Options” dialog for more settings

Capture Options

Before starting a capture, you can configure various options:

• Capture Filter: Restrict what packets are captured (reduces file size)
• Name Resolution: Resolve MAC, network, and transport-layer addresses
• Buffer Size: Adjust for high-volume captures
• Output Options: Save to a file, use multiple files, or ring buffer
• Stop Conditions: Automatically stop capturing after a certain time, number of packets, or file size

# Example capture filter to only capture HTTP traffic
tcp port 80 or tcp port 443

Saving Captured Data

To save your captured packets for later analysis:

1. Click on File > Save or press Ctrl+S (Cmd+S on macOS)
2. Choose a location and filename
3. Select a file format (typically .pcapng, which is the default)

Display and Capture Filters

Filtering is one of Wireshark’s most powerful features, allowing you to focus on exactly the traffic you’re interested in.

Capture Filters vs. Display Filters

It’s important to understand the difference:

• Capture Filters: Applied before packets are captured, reducing the amount of data collected. Uses BPF (Berkeley Packet Filter) syntax.
• Display Filters: Applied to packets that have already been captured, hiding unwanted packets from view. Uses Wireshark’s own syntax, which is more powerful but different from capture filter syntax.

Basic Display Filter Syntax

Display filters allow for complex expressions using comparison operators, logical operators, and protocol field references:

# Show only HTTP traffic
http

# Show only traffic to or from a specific IP
ip.addr == 192.168.1.1

# Show TCP packets with problems
tcp.analysis.flags

# Show all DNS queries
dns.flags.response == 0

# Combine filters with logical operators
http and not ip.addr == 192.168.1.1

Working with the Filter Expression Bar

Wireshark provides tools to help you build filters:

• Auto-completion as you type
• Color coding to indicate valid/invalid filters
• The ability to save and recall frequently used filters
• Right-click on packet fields and choose “Apply as Filter” to create filters based on selected values

Packet Analysis Techniques

Once you’ve captured packets, Wireshark offers numerous tools to analyze them effectively.

Following TCP Streams

One of the most useful features is the ability to follow TCP, UDP, or SSL streams:

1. Right-click on a packet that’s part of the stream you want to analyze
2. Select “Follow” and then choose the appropriate protocol (TCP/UDP/SSL Stream)
3. Wireshark will display the reassembled content of the entire conversation
4. For text-based protocols like HTTP, you’ll see the complete request and response
5. Switch between ASCII, HEX, C Arrays, and Raw display formats as needed

Protocol Hierarchy Statistics

To get a high-level view of the protocols in your capture:

1. Go to Statistics > Protocol Hierarchy
2. This shows a breakdown of all protocols detected and their percentage of total traffic
3. It’s arranged in a hierarchical view, allowing you to drill down from Ethernet to application protocols

IO Graphs

For visualizing traffic patterns over time:

1. Go to Statistics > I/O Graph
2. The default graph shows packets per second
3. You can add multiple graphs with different display filters and metrics (bytes, packets, etc.)
4. This is extremely useful for identifying traffic spikes, periodic behavior, or communication patterns

Expert Information

Wireshark includes an “expert system” that automatically identifies potential issues:

1. Go to Analyze > Expert Information
2. This shows warnings and errors categorized by type and severity
3. Common issues include TCP retransmissions, duplicate ACKs, and malformed packets

# Display filter to show only packets with expert info
_ws.expert

Network Troubleshooting

Wireshark is an invaluable tool for diagnosing network problems. Here are some common troubleshooting scenarios and how to address them:

Latency Issues

To investigate high latency problems:

1. Capture traffic between the problematic endpoints
2. Use Statistics > TCP Stream Graph > Round Trip Time Graph to visualize delays
3. Look for patterns of increased RTT or specific requests that take longer
4. Check for retransmissions with the display filter: tcp.analysis.retransmission

Connection Problems

When clients can’t connect to servers:

1. Capture traffic during connection attempts
2. Look for SYN packets without corresponding SYN-ACK responses
3. Check for ICMP “Port Unreachable” or other error messages
4. Verify that DNS resolution is working correctly with the filter: dns
5. For SSL/TLS connections, look for handshake failures: ssl.alert

Packet Loss

To identify packet loss on the network:

1. Look for TCP retransmissions: tcp.analysis.retransmission
2. Check for duplicate ACKs: tcp.analysis.duplicate_ack
3. Analyze TCP window size changes to identify flow control issues
4. Use Statistics > TCP Stream Graph > Time-Sequence Graph (Stevens) to visualize gaps

Bandwidth Utilization

To identify what’s consuming network bandwidth:

1. Use Statistics > Conversations to see top talkers
2. Sort by bytes to find the highest-volume connections
3. Drill down into specific conversations to identify the applications and protocols
4. Create IO Graphs with filters for specific hosts or protocols to visualize their bandwidth usage over time

Security Analysis with Wireshark

Wireshark is extensively used in security analysis and incident response. Here’s how you can leverage it for security purposes:

Detecting Suspicious Network Behavior

Look for these red flags:

• Unusual port scans: tcp.flags.syn == 1 and tcp.flags.ack == 0
• ARP spoofing attempts: arp.duplicate-address-detected or arp.duplicate-address-frame
• DNS tunneling: dns.qry.name.len > 50
• Excessive ICMP traffic: icmp && !icmp.type == 8 && !icmp.type == 0
• Connections to known malicious IPs (requires an updated list)

Analyzing Malware Traffic

When investigating potential malware:

1. Look for beaconing patterns (regular intervals of communication)
2. Check for unusual DNS queries to uncommon domains
3. Examine encrypted traffic for unusual patterns or destinations
4. Identify data exfiltration by looking for large uploads or unusual protocols

Detecting Data Leakage

To identify potential data leakage:

1. Follow TCP/HTTP streams to inspect unencrypted data
2. Look for sensitive information patterns (credit card numbers, SSNs, etc.)
3. Check for unencrypted protocols where encryption would be expected
4. Monitor unusual data transfers to external IP addresses

# Filter for passwords in clear text HTTP
http contains "password=" or http contains "pass=" or http contains "pwd="

Advanced Features

As you become more proficient with Wireshark, these advanced features can enhance your analysis capabilities:

Command Line Interface (tshark)

TShark is Wireshark’s command-line equivalent and is perfect for scripting and automation:

# Capture 100 packets and save to a file
tshark -c 100 -w output.pcap

# Read a capture file and apply a display filter
tshark -r input.pcap -Y "http" -T fields -e http.host -e http.request.uri

# Continuous capture with rotation and compression
tshark -i eth0 -b filesize:1024 -b files:5 -w capture.pcap

Dissectors and Protocols

Wireshark can decode hundreds of protocols, but you can extend it:

• Custom protocol dissectors can be written in Lua
• Protocol preferences can be adjusted under Edit > Preferences > Protocols
• You can enable experimental dissectors for newer protocols

Name Resolution

Enhance readability with various name resolution options:

• MAC address to manufacturer name
• IP address to hostname (via DNS)
• Transport-layer port to service name
• Custom name resolution using hosts files (Edit > Preferences > Name Resolution)

Profiles

Create and switch between different configurations:

1. Go to Edit > Configuration Profiles
2. Create profiles for different tasks (security analysis, troubleshooting, etc.)
3. Each profile can have its own columns, filters, coloring rules, and preferences

Decrypting Traffic

Wireshark can decrypt certain encrypted traffic with the right keys:

• TLS/SSL with private keys or pre-master secrets
• WPA/WPA2 wireless traffic with the passphrase
• IPsec with pre-shared keys

# Configure SSL decryption in the preferences
Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename