🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
BytesAgain β€Ί Skills β€Ί Wireshark Analysis
πŸ¦€ ClawHub

Wireshark Analysis

by @solomonneas

Network traffic analysis with Wireshark and tshark. Capture packets, write display and BPF filters, follow TCP/UDP/TLS streams, detect C2 beacons, troublesho...

Versionv1.0.1
Downloads832
#writing#legal
TERMINAL
clawhub install wireshark-analysis

πŸ“– About This Skill

name: Wireshark Network Traffic Analysis version: 1.0.0 description: "Network traffic analysis with Wireshark and tshark. Capture packets, write display and BPF filters, follow TCP/UDP/TLS streams, detect C2 beacons, troubleshoot connectivity, and perform forensic PCAP analysis." metadata: author: zebbern version: "1.1"

Wireshark Network Traffic Analysis

Purpose

Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.

Inputs / Prerequisites

Required Tools

  • Wireshark installed (Windows, macOS, or Linux)
  • Network interface with capture permissions
  • PCAP/PCAPNG files for offline analysis
  • Administrator/root privileges for live capture

    • Technical Requirements

  • Understanding of network protocols (TCP, UDP, HTTP, DNS)
  • Familiarity with IP addressing and ports
  • Knowledge of OSI model layers
  • Understanding of common attack patterns

    • Use Cases

  • Network troubleshooting and connectivity issues
  • Security incident investigation
  • Malware traffic analysis
  • Performance monitoring and optimization
  • Protocol learning and education

    • Outputs / Deliverables

    Primary Outputs

  • Filtered packet captures for specific traffic
  • Reconstructed communication streams
  • Traffic statistics and visualizations
  • Evidence documentation for incidents

    • Core Workflow

    Phase 1: Capturing Network Traffic

    #### Start Live Capture Begin capturing packets on network interface:

    1. Launch Wireshark
2. Select network interface from main screen
3. Click shark fin icon or double-click interface
4. Capture begins immediately

    #### Capture Controls | Action | Shortcut | Description | |--------|----------|-------------| | Start/Stop Capture | Ctrl+E | Toggle capture on/off | | Restart Capture | Ctrl+R | Stop and start new capture | | Open PCAP File | Ctrl+O | Load existing capture file | | Save Capture | Ctrl+S | Save current capture |

    #### Capture Filters Apply filters before capture to limit data collection:

    # Capture only specific host
host 192.168.1.100
    Capture specific port
    
port 80
    Capture specific network
    
net 192.168.1.0/24
    Exclude specific traffic
    
not arp
    Combine filters
    
host 192.168.1.100 and port 443

    Phase 2: Display Filters

    #### Basic Filter Syntax Filter captured packets for analysis:

    # IP address filters
ip.addr == 192.168.1.1              # All traffic to/from IP
ip.src == 192.168.1.1               # Source IP only
ip.dst == 192.168.1.1               # Destination IP only
    Port filters
    
tcp.port == 80                       # TCP port 80
udp.port == 53                       # UDP port 53
tcp.dstport == 443                   # Destination port 443
tcp.srcport == 22                    # Source port 22

    #### Protocol Filters Filter by specific protocols:

    # Common protocols
http                                  # HTTP traffic
https or ssl or tls                   # Encrypted web traffic
dns                                   # DNS queries and responses
ftp                                   # FTP traffic
ssh                                   # SSH traffic
icmp                                  # Ping/ICMP traffic
arp                                   # ARP requests/responses
dhcp                                  # DHCP traffic
smb or smb2                          # SMB file sharing

    #### TCP Flag Filters Identify specific connection states:

    tcp.flags.syn == 1                   # SYN packets (connection attempts)
tcp.flags.ack == 1                   # ACK packets
tcp.flags.fin == 1                   # FIN packets (connection close)
tcp.flags.reset == 1                 # RST packets (connection reset)
tcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN-only (initial connection)

    #### Content Filters Search for specific content:

    frame contains "password"            # Packets containing string
http.request.uri contains "login"    # HTTP URIs with string
tcp contains "GET"                   # TCP packets with string

    #### Analysis Filters Identify potential issues:

    tcp.analysis.retransmission          # TCP retransmissions
tcp.analysis.duplicate_ack           # Duplicate ACKs
tcp.analysis.zero_window             # Zero window (flow control)
tcp.analysis.flags                   # Packets with issues
dns.flags.rcode != 0                 # DNS errors

    #### Combining Filters Use logical operators for complex queries:

    # AND operator
ip.addr == 192.168.1.1 && tcp.port == 80
    OR operator
    
dns || http
    NOT operator
    
!(arp || icmp)
    Complex combinations
    
(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443

    Phase 3: Following Streams

    #### TCP Stream Reconstruction View complete TCP conversation:

    1. Right-click on any TCP packet
2. Select Follow > TCP Stream
3. View reconstructed conversation
4. Toggle between ASCII, Hex, Raw views
5. Filter to show only this stream

    #### Stream Types | Stream | Access | Use Case | |--------|--------|----------| | TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP | | UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming | | HTTP Stream | Follow > HTTP Stream | Web content, headers | | TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) |

    #### Stream Analysis Tips

  • Review request/response pairs
  • Identify transmitted files or data
  • Look for credentials in plaintext
  • Note unusual patterns or commands

    • Phase 4: Statistical Analysis

    #### Protocol Hierarchy View protocol distribution:

    Statistics > Protocol Hierarchy
    Shows:

  • Percentage of each protocol
    • 

  • Packet counts
    • 

  • Bytes transferred
    • 

  • Protocol breakdown tree
    •

    #### Conversations Analyze communication pairs:

    Statistics > Conversations
    Tabs:

  • Ethernet: MAC address pairs
    • 

  • IPv4/IPv6: IP address pairs
    • 

  • TCP: Connection details (ports, bytes, packets)
    • 

  • UDP: Datagram exchanges
    •

    #### Endpoints View active network participants:

    Statistics > Endpoints
    Shows:

  • All source/destination addresses
    • 

  • Packet and byte counts
    • 

  • Geographic information (if enabled)
    •

    #### Flow Graph Visualize packet sequence:

    Statistics > Flow Graph
    Options:

  • All packets or displayed only
    • 

  • Standard or TCP flow
    • 

  • Shows packet timing and direction
    •

    #### I/O Graphs Plot traffic over time:

    Statistics > I/O Graph
    Features:

  • Packets per second
    • 

  • Bytes per second
    • 

  • Custom filter graphs
    • 

  • Multiple graph overlays
    •

    Phase 5: Security Analysis

    #### Detect Port Scanning Identify reconnaissance activity:

    # SYN scan detection (many ports, same source)
ip.src == SUSPECT_IP && tcp.flags.syn == 1
    Review Statistics > Conversations for anomalies
    

    Look for single source hitting many destination ports

    #### Identify Suspicious Traffic Filter for anomalies:

    # Traffic to unusual ports
tcp.dstport > 1024 && tcp.dstport < 49152
    Traffic outside trusted network
    
!(ip.addr == 192.168.1.0/24)
    Unusual DNS queries
    
dns.qry.name contains "suspicious-domain"
    Large data transfers
    
frame.len > 1400

    #### ARP Spoofing Detection Identify ARP attacks:

    # Duplicate ARP responses
arp.duplicate-address-frame
    ARP traffic analysis
    
arp
    Look for:
    

    - Multiple MACs for same IP
    

    - Gratuitous ARP floods
    

    - Unusual ARP patterns

    #### Examine Downloads Analyze file transfers:

    # HTTP file downloads
http.request.method == "GET" && http contains "Content-Disposition"
    Follow HTTP Stream to view file content
    

    Use File > Export Objects > HTTP to extract files

    #### DNS Analysis Investigate DNS activity:

    # All DNS traffic
dns
    DNS queries only
    
dns.flags.response == 0
    DNS responses only
    
dns.flags.response == 1
    Failed DNS lookups
    
dns.flags.rcode != 0
    Specific domain queries
    
dns.qry.name contains "domain.com"

    Phase 6: Expert Information

    #### Access Expert Analysis View Wireshark's automated findings:

    Analyze > Expert Information
    Categories:

  • Errors: Critical issues
    • 

  • Warnings: Potential problems
    • 

  • Notes: Informational items
    • 

  • Chats: Normal conversation events
    •

    #### Common Expert Findings | Finding | Meaning | Action | |---------|---------|--------| | TCP Retransmission | Packet resent | Check for packet loss | | Duplicate ACK | Possible loss | Investigate network path | | Zero Window | Buffer full | Check receiver performance | | RST | Connection reset | Check for blocks/errors | | Out-of-Order | Packets reordered | Usually normal, excessive is issue |

    Quick Reference

    Keyboard Shortcuts

    | Action | Shortcut | |--------|----------| | Open file | Ctrl+O | | Save file | Ctrl+S | | Start/Stop capture | Ctrl+E | | Find packet | Ctrl+F | | Go to packet | Ctrl+G | | Next packet | ↓ | | Previous packet | ↑ | | First packet | Ctrl+Home | | Last packet | Ctrl+End | | Apply filter | Enter | | Clear filter | Ctrl+Shift+X |

    Common Filter Reference

    # Web traffic
http || https
    Email
    
smtp || pop || imap
    File sharing  
    
smb || smb2 || ftp
    Authentication
    
ldap || kerberos
    Network management
    
snmp || icmp
    Encrypted
    
tls || ssl

    Export Options

    File > Export Specified Packets    # Save filtered subset
File > Export Objects > HTTP       # Extract HTTP files
File > Export Packet Dissections   # Export as text/CSV

    Constraints and Guardrails

    Operational Boundaries

  • Capture only authorized network traffic
  • Handle captured data according to privacy policies
  • Avoid capturing sensitive credentials unnecessarily
  • Properly secure PCAP files containing sensitive data

    • Technical Limitations

  • Large captures consume significant memory
  • Encrypted traffic content not visible without keys
  • High-speed networks may drop packets
  • Some protocols require plugins for full decoding

    • Best Practices

  • Use capture filters to limit data collection
  • Save captures regularly during long sessions
  • Use display filters rather than deleting packets
  • Document analysis findings and methodology

    • Examples

    Example 1: HTTP Credential Analysis

    Scenario: Investigate potential plaintext credential transmission

    1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters

    Finding: Credentials transmitted in cleartext form data.

    Example 2: Malware C2 Detection

    Scenario: Identify command and control traffic

    1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns

    Indicators:

  • Regular timing intervals
  • Encoded/encrypted payloads
  • Unusual ports or protocols

    • Example 3: Network Troubleshooting

    Scenario: Diagnose slow web application

    1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss

    Finding: TCP retransmissions indicating network congestion.

    Troubleshooting

    No Packets Captured

  • Verify correct interface selected
  • Check for admin/root permissions
  • Confirm network adapter is active
  • Disable promiscuous mode if issues persist

    • Filter Not Working

  • Verify filter syntax (red = error)
  • Check for typos in field names
  • Use Expression button for valid fields
  • Clear filter and rebuild incrementally

    • Performance Issues

  • Use capture filters to limit traffic
  • Split large captures into smaller files
  • Disable name resolution during capture
  • Close unnecessary protocol dissectors

    • Cannot Decrypt TLS/SSL

  • Obtain server private key
  • Configure at Edit > Preferences > Protocols > TLS
  • For ephemeral keys, capture pre-master secret from browser
  • Some modern ciphers cannot be decrypted passively

    • ⚑ When to Use

    TriggerAction
    - Security incident investigation
    - Malware traffic analysis
    - Performance monitoring and optimization
    - Protocol learning and education

    πŸ’‘ Examples

    Example 1: HTTP Credential Analysis

    Scenario: Investigate potential plaintext credential transmission

    1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters

    Finding: Credentials transmitted in cleartext form data.

    Example 2: Malware C2 Detection

    Scenario: Identify command and control traffic

    1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns

    Indicators:

  • Regular timing intervals
  • Encoded/encrypted payloads
  • Unusual ports or protocols

    • Example 3: Network Troubleshooting

    Scenario: Diagnose slow web application

    1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss

    Finding: TCP retransmissions indicating network congestion.

    πŸ“‹ Tips & Best Practices

  • Use capture filters to limit data collection
  • Save captures regularly during long sessions
  • Use display filters rather than deleting packets
  • Document analysis findings and methodology