Understanding computer networking & analysing network traffic are essential skills for network security. Whether you are a network administrator, a network engineer, a troubleshooter, a network security expert, or a DFIR Investigator, you must have network traffic analysis skills.

Wireshark is a network traffic inspection tool which is going to help to analyse your network traffic.

In this blog, we have covered,

• Why Analysing Network Traffic Is An Essential Skill?
• What Is Wireshark?
• Why Use Wireshark?
• Key Uses of Wireshark
• Key Features of Wireshark
• Installing Wireshark
• Launching & Capturing Network Traffic
• Introduction to Wireshark Capture Screen
• Live Packet Inspection

Get PriOFF’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Introduction to Wireshark Capture Screen

Now, clear the filter and click on the first interface on your wireshark home screen.

Usually the first interface gonna be your machine’s main network interface. Here I have seen ‘Ethernet0’, You may have ‘WiFi’ or if you are using debian based systems you will see ‘eth0’ interaface.

Here, You can view a cheatsheet for wirkshark

https://cdn.comparitech.com/wp-content/uploads/2019/06/Wireshark-Cheat-Sheet.pdf

Once you click the Wireshark Dashboard will open and capturing process will start.

1. Menubar: This is a typical traditional menubar, where you can find multiple options such as File, Edit, View, Go, Capture, Analyze, Statistics, Telephony, Wireless, Tools and Help

2. Capture bar: This can be found below the menubar. Allows you to start, stop, recapture, settings for capture, open pcap files, zoom-in, zoom-out for live capturing.

3. Display Filter bar: Below that we have filter bar. Don’t get mixed up this with capture filters. Display filters and capture filters both are different. Capture filters only captures traffic according to given filters. Whereas Display filters allows to you filter out traffic from captured traffic.

4. Capture screen: In capture screen, we can see No., Time, Source, Destination, Protocol, Length, Info columns.

5. Packet screen: Here you can see the selected Packet fields and headers in packet screen. You will gonna analysis your selected packets here.

6. Data screen: At last we have Data Screen where you can see Hax format of the selected packet.

Live Packet Inspection using wireshark

Now, once you understand the capture screen of wireshark, you won’t be confused with the panels and it will be easy for you to analyse the network traffic.

Now, Restart the Capturing by clicking on the restart capture button on the capture bar

Now, once your capture restarts, visit youtube.com in your browser.

Now you can use below display filter to filter-out the packet which contains “youtube” inside their frames.

Now, let’s try to login on a website and see if we get the credentials from the packets?

For testing purpose I’m using acunetix’s testasp website.

Let’s login here. Again this site is running on HTTP, not HTTPS.

Login failed, Now let’s back to the wireshark and analysis if we get any packet contains login credentials.

Now, Let’s apply filters to filter out the packets we are looking for.

Here, you can clearly see that all the traffic is listed here including visiting testasp website’s login page.

Now let’s look for login credentials.

If you look closely, the last request is POST Request. Generally means it can be the POST request when we hit login with the credentials.

For Inspecting and analysing the packet, click on it and you can see changes in the frame screen on your bottom left area, revealing details of packets.

Let’s analyse this frame.

Wireshark organizes captured network data into a hierarchical structure, showing how high-level protocols (HTTP) are encapsulated within lower-level protocols (TCP, IPv4, Ethernet). Each packet is displayed as a frame, breaking down the headers and payloads of each layer to visualize how data moves across a network.

Here you can see total 5 layers’s data. Let’s go for each one by one.

1. Packet Frame (Layer 1 — Physical):

• The “pseudo-protocol” created by Wireshark to show details of the physical packet capture.
• Shows the frame number, arrival time, time delta (time since previous packet), frame length (total size), and interface ID.

Tells you when and how the packet was captured by your NIC

2. Ethernet II (Layer 2 — Data Link):

• The local network connection, handling communication between local devices (e.g., computer and router).

Wireshark Details:

• Destination/Source MAC Address: Physical addresses of the network interfaces.
• Type: Identifies the network layer protocol (e.g., IPv4 is 0x0800).

If your traffic is going to the internet, the destination MAC is your default gateway (router), not the final destination.

3. IPv4 (Layer 3 — Network):

• Handles addressing and routing across networks (internet).

Wireshark Details:

• Source/Destination IP Address: The logical, logical address of the client and server.
• Protocol: Identifies the transport layer (e.g., 6 for TCP).

Shows the path and logical origin/destination of the data

4. TCP — Transmission Control Protocol (Layer 4 — Transport):

• Ensures reliable communication between the source and destination through segmentation and acknowledgement.

Wireshark Details:

• Source/Destination Port: Identifies the specific applications (e.g., 80 for HTTP).
• Sequence/Acknowledgment Number: Tracks packet ordering and ensures all data is received.
• Flags: Syn, Ack, Fin, Psh, Rst (indicates connection state).

If you see many packets with only flags (SYN, ACK, FIN), it is the “handshake” or “teardown” of the connection

5. HTTP — Hypertext Transfer Protocol (Layer 7 — Application):

• The application layer protocol used to transmit web data.
• Wireshark Details:
• Method: GET, POST, etc..
• URI/URL: The resource being requested.
• Response Code: E.g., 200 OK, 404 Not Found.

In Wireshark, this is the readable part, showing the actual request or content requested from the server.

6. Form Data:

And lasly we have form data passed by the request.

Here we can find userame and password passed inside the login request.

This is how you can deeply inspect packets Live in wireshark. But this is only a single use of wireshark (Live Packet Inspection).

But you can also collect & analyze Network Artifacts which will discuss in our upcoming article. In upcoming article, we will see how we can use wireshark to Collect, analyze, and build documantiation on Network Artifacts helping in Network Forensics. Which is gonna be very valuable for Investigators, Threat Hunters, and Network Forensics Experts !

Let me know, if you want me to cover any specific topic or article in my upcoming blogs.

Also, Don’t forget to subscribe! So, you don’t miss my upcoming wireshark blog. Hit claps if you like my blog, this helps infer me that you like my content.

Comment on this if you want me to cover specific topic, tool, etc. and let me know, if you find this informative and share with your friends, colleagues, seniors and juniors & help them to reduce their headache.

See you in next blog. Till then keep learning & keep going.