Learn some Wireshark basics!

Chris Aniskovich
Jan 30, 2024
2 min read

01/30/24

Wireshark is a robust and open-source network protocol analyzer that empowers users to inspect, capture, and analyze the data flowing through a computer network. This powerful tool provides real-time visibility into the intricate world of network communications, allowing users to understand and troubleshoot network issues, identify security threats, and gain valuable insights into the behavior of various protocols.

This will be the start of a brand new free learning content where we explore tools and commands used for Ethical Hacking and Information Gathering.

Wireshark is a powerful network protocol analyzer that allows you to capture and inspect the data traveling back and forth on a network in real-time. Here are the basics to get you started:

1. Download and Install Wireshark:

You can download Wireshark from wireshark.org.
Install it on your computer following the on-screen instructions.

2. Start Capturing Traffic:

Open Wireshark and select the network interface (e.g., Wi-Fi, Ethernet) you want to capture traffic on.
Click on the "Start" button to begin capturing packets.

3. Understanding the Wireshark Interface:

Packet List Pane: Displays a list of captured packets.
Packet Details Pane: Provides detailed information about the selected packet.
Packet Bytes Pane: Shows the raw hexadecimal data of the selected packet.

4. Filtering Packets:

Use display filters to focus on specific types of packets.
For example, tcp filters only TCP packets, and ip.src == 192.168.1.1 filters packets with a source IP of 192.168.1.1.

5. Inspecting Packets:

Click on any packet in the list to view detailed information in the Packet Details Pane.
Analyze various fields like source and destination addresses, protocol type, flags, and more.

6. Color Coding:

Wireshark color-codes packets for easier analysis. For example, green for TCP, blue for UDP, etc.

7. Follow TCP Stream:

Right-click on a TCP packet and select "Follow" > "TCP Stream" to see the entire conversation between two devices.

8. Statistics:

Wireshark provides various statistical tools. Check the "Statistics" menu for options like conversations, protocol hierarchy, and endpoint lists.

9. Save and Export:

Save captured packets for future analysis or share them with others. Use the "File" menu for saving or exporting.

10. Useful Tools:

Wireshark comes with additional tools like "IO Graphs" and "Expert Info" that provide visualizations and insights into network behavior.

11. Learn Common Protocols:

Understanding common protocols like HTTP, DNS, and TCP/UDP will help you make sense of the captured data.

12. Tutorials and Documentation:

Refer to Wireshark's official documentation and tutorials for more in-depth learning.

13. Stay Ethical:

Always use Wireshark ethically and in compliance with laws. Unauthorized interception of network traffic is illegal.

Remember, Wireshark can be complex, and continuous practice is key to mastering it. Happy blogging!