Wireshark is a powerful and widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It’s essential for network administrators, cybersecurity professionals, and anyone interested in understanding network traffic. This guide will explain how to use Wireshark in detail, with examples to illustrate its functionality.

Table of Contents

  1. Introduction to Wireshark
  2. Installing Wireshark
  3. Capturing Traffic
  4. Filtering Traffic
  5. Analyzing Traffic
  6. Examples of Common Use Cases
  7. Advanced Features
  8. Conclusion

Introduction to Wireshark

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark allows you to see what’s happening on your network at a microscopic level, making it an invaluable tool for diagnosing network issues.

Key Features

  • Deep inspection of hundreds of protocols.
  • Live capture and offline analysis.
  • Rich VoIP analysis.
  • Decryption support for many protocols.
  • Customizable reports and visualizations.

Installing Wireshark

Windows

  1. Download the Installer: Visit the Wireshark download page and download the Windows installer.
  2. Run the Installer: Follow the installation wizard to install Wireshark and the necessary components (WinPcap or npcap).
  3. Complete the Installation: Finish the setup and launch Wireshark.

macOS

  1. Download from Homebrew: Open Terminal and install Wireshark using Homebrew:
    bash brew install --cask wireshark
  2. Install the Necessary Components: Follow the on-screen instructions to install additional components if needed.

Linux

  1. Install via Package Manager: Use the package manager for your distribution. For example, on Ubuntu:
    bash sudo apt-get update sudo apt-get install wireshark
  2. Grant Permissions: You may need to run Wireshark with elevated permissions or add your user to the Wireshark group:
    bash sudo usermod -aG wireshark $USER

Capturing Traffic

  1. Select the Network Interface: Upon launching Wireshark, you will see a list of available network interfaces. Select the one you want to monitor.
  2. Start Capturing: Click on the shark fin icon or press Ctrl + E to start capturing traffic.
  3. Stop Capturing: Click the red square or press Ctrl + E again to stop the capture.

Example

To capture traffic on a Wi-Fi interface:

  1. Open Wireshark.
  2. Select the Wi-Fi interface from the list.
  3. Click the shark fin icon to start capturing.
  4. Browse some websites or perform network activities to generate traffic.
  5. Click the red square to stop capturing.

Filtering Traffic

Filters are crucial in Wireshark as they help isolate specific packets of interest from potentially overwhelming amounts of data.

Capture Filters

Capture filters limit the packets that Wireshark records. They are set before starting the capture.

Example: Capture only HTTP traffic

tcp port 80

Display Filters

Display filters are applied after capturing and are used to show only the packets that match the filter criteria.

Example: Display only HTTP traffic

http

Combining Filters

You can combine filters using logical operators like and, or, and not.

Example: Display HTTP or HTTPS traffic

http or ssl

Analyzing Traffic

Once you have captured and filtered the traffic, the next step is analysis.

Packet Details

Click on a packet to view its details. The pane below the packet list shows the packet structure divided into different protocol layers (e.g., Ethernet, IP, TCP).

Follow Stream

To analyze a complete conversation between two endpoints, right-click on a packet and select “Follow” -> “TCP Stream” (or HTTP, UDP, etc.). This feature reconstructs the data exchanged in a readable format.

Statistics and Graphs

Wireshark provides various statistics and graphs under the “Statistics” menu.

Example: TCP Stream Graph

  1. Go to Statistics -> TCP Stream Graph -> Time-Sequence-Graph (Stevens).
  2. Select the stream to visualize TCP flow characteristics.

Examples of Common Use Cases

Analyzing HTTP Traffic

  1. Capture HTTP Traffic: Apply a display filter for HTTP:
    bash http
  2. Follow the Stream: Right-click on an HTTP packet and select “Follow” -> “HTTP Stream” to see the full request and response.

Detecting Network Latency

  1. ICMP Echo Requests: Use display filters to find ICMP packets:
    bash icmp
  2. Analyze Round-Trip Time: Examine the time delta between request and reply packets.

Troubleshooting Slow Application Performance

  1. Capture Traffic: Start capturing on the relevant interface.
  2. Filter by Application Protocol: Use appropriate filters (e.g., http, dns).
  3. Analyze Response Times: Look for delays in the responses.

Advanced Features

Customizing Columns

You can customize the columns in the packet list pane to show specific fields:

  1. Right-click on any column header and select “Column Preferences”.
  2. Add or modify columns to display the desired information.

Exporting Data

Wireshark allows exporting captured data in various formats:

  1. Export Packet Dissections: Go to File -> Export Packet Dissections -> As CSV, PSML, or Plain Text.
  2. Export Specific Packets: Select packets and go to File -> Export Specified Packets.

Scripting with Tshark

Tshark is the command-line version of Wireshark. It can be used for automated or scripted captures and analyses.

Example: Capture traffic on interface eth0 and save to file

tshark -i eth0 -w capture.pcap

Conclusion

Wireshark is an indispensable tool for anyone working with networks. By capturing and analyzing network traffic, it provides deep insights into the behavior and performance of networked applications. This guide has covered the basics of installing Wireshark, capturing and filtering traffic, and using advanced features. With practice, you can become proficient in diagnosing network issues and improving network security.

Feel free to explore Wireshark’s extensive documentation and user community for more advanced tips and tricks.

Credits: