Wireshark Network Traffic Analysis

Purpose

Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.

Inputs / Prerequisites

Required Tools

• - Wireshark installed (Windows, macOS, or Linux)
• Network interface with capture permissions
• PCAP/PCAPNG files for offline analysis
• Administrator/root privileges for live capture

Technical Requirements

• - Understanding of network protocols (TCP, UDP, HTTP, DNS)
• Familiarity with IP addressing and ports
• Knowledge of OSI model layers
• Understanding of common attack patterns

Use Cases

• - Network troubleshooting and connectivity issues
• Security incident investigation
• Malware traffic analysis
• Performance monitoring and optimization
• Protocol learning and education

Outputs / Deliverables

Primary Outputs

• - Filtered packet captures for specific traffic
• Reconstructed communication streams
• Traffic statistics and visualizations
• Evidence documentation for incidents

Core Workflow

Phase 1: Capturing Network Traffic

Start Live Capture

CODEBLOCK0

Capture Controls

Action	Shortcut	Description
Start/Stop Capture	Ctrl+E	Toggle capture on/off
Restart Capture

Ctrl+R | Stop and start new capture |

Capture Filters

CODEBLOCK1

Phase 2: Display Filters

Basic Filter Syntax

CODEBLOCK2

Protocol Filters

CODEBLOCK3

TCP Flag Filters

CODEBLOCK4

Content Filters

CODEBLOCK5

Analysis Filters

CODEBLOCK6

Combining Filters

CODEBLOCK7

Phase 3: Following Streams

TCP Stream Reconstruction

CODEBLOCK8

Stream Types

Stream	Access	Use Case
TCP Stream	Follow > TCP Stream	Web, file transfers, any TCP
UDP Stream

Follow > UDP Stream | DNS, VoIP, streaming |

Stream Analysis Tips

• - Review request/response pairs
• Identify transmitted files or data
• Look for credentials in plaintext
• Note unusual patterns or commands

Phase 4: Statistical Analysis

Protocol Hierarchy

CODEBLOCK9

Conversations

CODEBLOCK10

Endpoints

CODEBLOCK11

Flow Graph

CODEBLOCK12

I/O Graphs

CODEBLOCK13

Phase 5: Security Analysis

Detect Port Scanning

CODEBLOCK14

Identify Suspicious Traffic

CODEBLOCK15

ARP Spoofing Detection

CODEBLOCK16

Examine Downloads

CODEBLOCK17

DNS Analysis

CODEBLOCK18

Phase 6: Expert Information

Access Expert Analysis

CODEBLOCK19

Common Expert Findings

Finding	Meaning	Action
TCP Retransmission	Packet resent	Check for packet loss
Duplicate ACK

Possible loss | Investigate network path |

Quick Reference

Keyboard Shortcuts

Action	Shortcut
Open file	Ctrl+O
Save file

Ctrl+S |

Common Filter Reference

Export Options

Constraints and Guardrails

Operational Boundaries

• - Capture only authorized network traffic
• Handle captured data according to privacy policies
• Avoid capturing sensitive credentials unnecessarily
• Properly secure PCAP files containing sensitive data

Technical Limitations

• - Large captures consume significant memory
• Encrypted traffic content not visible without keys
• High-speed networks may drop packets
• Some protocols require plugins for full decoding

Best Practices

• - Use capture filters to limit data collection
• Save captures regularly during long sessions
• Use display filters rather than deleting packets
• Document analysis findings and methodology

Examples

Example 1: HTTP Credential Analysis

Scenario: Investigate potential plaintext credential transmission

CODEBLOCK22

Finding: Credentials transmitted in cleartext form data.

Example 2: Malware C2 Detection

Scenario: Identify command and control traffic

CODEBLOCK23

Indicators:

• - Regular timing intervals
• Encoded/encrypted payloads
• Unusual ports or protocols

Example 3: Network Troubleshooting

Scenario: Diagnose slow web application

CODEBLOCK24

Finding: TCP retransmissions indicating network congestion.

Troubleshooting

No Packets Captured

• - Verify correct interface selected
• Check for admin/root permissions
• Confirm network adapter is active
• Disable promiscuous mode if issues persist

Filter Not Working

• - Verify filter syntax (red = error)
• Check for typos in field names
• Use Expression button for valid fields
• Clear filter and rebuild incrementally

Performance Issues

• - Use capture filters to limit traffic
• Split large captures into smaller files
• Disable name resolution during capture
• Close unnecessary protocol dissectors

Cannot Decrypt TLS/SSL

• - Obtain server private key
• Configure at Edit > Preferences > Protocols > TLS
• For ephemeral keys, capture pre-master secret from browser
• Some modern ciphers cannot be decrypted passively