Tutorials

1. INTRODUCTION

Wireshark is the most widely used packet analyzer for:

It allows capturing, filtering, decoding, and inspecting every packet on the network.

2. CAPTURING TRAFFIC

Start capture:

Promiscuous mode:

Monitor mode (Wi-Fi):

3. BASIC FILTERING

Common display filters:

bash

ip.addr == 10.10.10.5

bash

tcp.port == 80

bash

udp.port == 53

bash

http

bash

dns

bash

arp

bash

icmp

4. COMBINATION FILTERS

AND:

bash

ip.src==10.0.0.5 && tcp.port==443

OR:

bash

tcp || udp

NOT:

bash

!arp

5. FOLLOW STREAM

Follow TCP stream:

Useful for:

6. DECRYPTING HTTP/HTTPS

HTTP:

HTTPS decryption (if server private key available):

Supports *RSA-based TLS only* (not modern ECDHE).

7. PACKET COLORING

Coloring rules help identify protocol behavior.

Default:

8. USEFUL PROTOCOL FILTERS

HTTP:

bash

http.request.method=="POST"

DNS:

bash

dns.qry.name == "example.com"

DHCP:

bash

bootp

TLS handshake:

bash

tls.handshake

ARP:

bash

arp.opcode==1

9. EXTRACTING FILES FROM TRAFFIC

Extract files:

Useful for:

10. WIRELESS (802.11) ANALYSIS

Enable monitor mode:

bash

airmon-ng start wlan0

Allows capturing:

11. CAPTURING A WPA2 HANDSHAKE

Start monitor mode:

bash

airmon-ng start wlan0

Use EAPOL filter:

bash

eapol

Used later for Wi-Fi cracking with hashcat.

12. EXPERT INFORMATION VIEW

Analyze → Expert Information

Shows:

13. EXPORTING PCAP FILES

Save capture:

Export specific packets:

14. MALWARE ANALYSIS USE CASES

Wireshark helps detect:

1. INTRODUCTION

2. CAPTURING TRAFFIC

3. BASIC FILTERING

4. COMBINATION FILTERS

5. FOLLOW STREAM

6. DECRYPTING HTTP/HTTPS

7. PACKET COLORING

8. USEFUL PROTOCOL FILTERS

9. EXTRACTING FILES FROM TRAFFIC

10. WIRELESS (802.11) ANALYSIS

11. CAPTURING A WPA2 HANDSHAKE

12. EXPERT INFORMATION VIEW

13. EXPORTING PCAP FILES

14. MALWARE ANALYSIS USE CASES

15. CTF WORKFLOW