Packet Analysis with Wireshark — Essentials Guide
Start a capture
Pick the interface with the moving traffic sparkline — that is where the packets are. Wired problems: the Ethernet NIC. Wi-Fi problems: the wireless NIC. Then just press the shark fin and reproduce the problem; stop soon after, small captures are readable captures.
Capture filters vs display filters
- Capture filter — decides what gets recorded (BPF syntax, e.g.
port 53). Whatever it excludes is gone forever. - Display filter — decides what is shown; the full recording stays intact.
The professional habit: capture broadly, filter on display — you rarely know in advance which packets will matter.
Display-filter cookbook
| You want to see | Type / do this |
|---|---|
| All traffic to or from a host | ip.addr == 192.168.1.10 |
| Only one direction | ip.src == 192.168.1.10 or ip.dst == ... |
| A TCP service (HTTPS) | tcp.port == 443 |
| A UDP service (DNS transport) | udp.port == 53 |
| DNS queries and answers | dns |
| Cleartext web | http |
| Encrypted web (handshake readable, payload not) | tls |
| Ping and ICMP errors | icmp |
| Who-has / is-at on the LAN | arp |
| Connection attempts only (client SYN) | tcp.flags.syn == 1 && tcp.flags.ack == 0 |
| Both halves of every handshake | tcp.flags.syn == 1 |
| Lost-and-resent segments | tcp.analysis.retransmission |
| Raw text anywhere in a packet | frame contains "login" |
| One whole conversation | right-click a packet → Follow → TCP Stream |
| What is actually in this capture | Statistics → Protocol Hierarchy |
Reading a conversation — the recipe
- Filter to the machine:
ip.addr == <its IP>. - Find the opening: the DNS query, then the handshake (
tcp.flags.syn == 1). - Follow the TCP stream — the two sides of the dialogue in plain view.
- Watch the clock: a growing gap between request and response is the slowness.
- Hunt trouble marks: retransmissions, resets (RST), and dark-colored rows.
Expert Info severity colors
Analyze → Expert Information summarizes what Wireshark noticed: Chat (blue) normal milestones · Note (cyan) noteworthy, usually fine (duplicate ACKs) · Note (cyan) noteworthy, often normal alone — duplicate ACKs and retransmissions · Warn (yellow) likely problems (resets, zero window, previous segment not captured) · Error (red) malformed or serious. Yellow and red are your reading list.
Privacy and ethics. A capture records everyone's activity on that segment — sites visited, names, even credentials on cleartext protocols. Capture only networks you are authorized to analyze, treat .pcap files as confidential documents, and delete them when the investigation ends.
Troubleshooting with Wireshark — quick map
| Suspicion | What it looks like |
|---|---|
| DNS is failing | dns shows queries with no responses, or answers carrying errors — repeated retries for the same name |
| The link is lossy / app is slow | clusters of tcp.analysis.retransmission, duplicate ACKs, stretched response times |
| ARP storm / loop | the arp filter fills the screen — the same who-has broadcasts repeating far faster than normal |
| Duplicate IP address | two different MACs answering is-at for one IP (Wireshark flags it in Expert Info) |
Network Essentials · Turning Point Academy — backbone: Al-Doori, Network Essentials, Ch. 10 & 13.