Packet Analysis with Wireshark

From Raw Packets to Security Insights

Wireshark is the most widely used network protocol analyzer. It captures raw network traffic and presents it in a structured, human-readable format. For security professionals, Wireshark is both a diagnostic tool and a forensic instrument — it lets you see exactly what crossed the wire, which is the ground truth that no log file can contradict.

Capturing Traffic

Wireshark captures traffic by putting the network interface into promiscuous mode, allowing it to see all traffic on the network segment, not just traffic addressed to the capturing host.

Capture options that matter for security:

• Capture filter: Applied at the kernel level before packets are stored. Use host 192.168.1.100 and port 443 to capture only traffic to/from a specific host on a specific port. Capture filters use BPF (Berkeley Packet Filter) syntax.

• Promiscuous mode: Captures all traffic on the segment, not just traffic addressed to the capturing host. Essential for seeing other hosts' traffic on a shared network.

• Monitor mode (wireless): Captures all wireless traffic on a channel, not just traffic associated with your network. Required for wireless security analysis.

# Command-line capture with tshark (Wireshark's CLI equivalent)
tshark -i eth0 -f "host 192.168.1.100" -w capture.pcap

# Capture only DNS traffic
tshark -i eth0 -f "port 53" -w dns_capture.pcap

# Capture with ring buffer (rotate files every 100MB)
tshark -i eth0 -b filesize:100000 -w capture.pcap

Display Filters: Isolating What Matters

A capture file may contain millions of packets. Display filters let you isolate the traffic relevant to your investigation. Display filters are applied after capture and use Wireshark's filter syntax.

Essential display filters for security analysis:

# Filter by IP address
ip.addr == 192.168.1.100
ip.src == 192.168.1.100
ip.dst == 192.168.1.100

# Filter by port
 tcp.port == 443
udp.port == 53

# Filter by protocol
http
dns
arp
icmp

# Filter by TCP flags (useful for scan detection)
tcp.flags.syn == 1 && tcp.flags.ack == 0    # SYN packets (connection attempts)
tcp.flags.reset == 1                        # RST packets (connection resets)
tcp.flags.fin == 1                         # FIN packets (connection close)

# Filter by HTTP attributes
http.request.method == "POST"
http.response.code == 404
http.host == "example.com"
http.user_agent contains "sqlmap"

# Filter by DNS attributes
dns.qry.name contains "tunnel"
ns.qry.type == 16    # TXT records (tunneling indicator)

# Combine filters
ip.addr == 192.168.1.100 && tcp.port == 443
http.request.method == "POST" && http.host == "bank.example.com"

The Wireshark Interface: Three Panes

Wireshark displays captured traffic in three panes:

1. Packet list (top): One line per packet — number, time, source, destination, protocol, length, info. This is your overview. Color coding highlights protocol types and anomalies.

2. Packet details (middle): The protocol stack for the selected packet, expandable to show each layer's fields. This is where you inspect individual packet contents.

3. Packet bytes (bottom): The raw hexadecimal and ASCII representation of the packet. This is the ground truth — what actually crossed the wire.

Color Coding and Expert Info

Wireshark color-codes packets by protocol and anomaly:

• Light blue: TCP traffic
• Light purple: UDP traffic
• Light green: HTTP traffic
• Red: Errors (TCP retransmissions, malformed packets, RST)
• Black: Packets with problems (duplicate ACKs, zero windows)

Expert Info (Analyze → Expert Information) aggregates anomalies:

• Errors: Malformed packets, checksum errors
• Warnings: Retransmissions, duplicate ACKs, zero windows
• Notes: Keep-alive, window updates, TCP window full
• Chats: Connection establishment, teardown

For security analysis, focus on Errors and Warnings — they indicate network problems, scanning activity, or evasion attempts.

The Analysis Techniques That Find Attacks

Following TCP Streams

The most powerful feature for security analysis is Follow TCP Stream (right-click a packet → Follow → TCP Stream). This reassembles all packets in a TCP connection in order, showing the complete application-layer conversation.

# Example: Following an HTTP session
# The stream shows the full request/response:

GET /api/users/1 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOi...

HTTP/1.1 200 OK
Content-Type: application/json

{"id": 1, "username": "admin", "email": "admin@example.com"}

Forensic value: You see exactly what data was transmitted, including credentials in Authorization headers, session tokens in cookies, and payloads in POST bodies. This is the ground truth — no application log can contradict what you see in the TCP stream.

Color coding in stream view: Red is client-to-server traffic, blue is server-to-client traffic. This makes it easy to distinguish requests from responses.

Detecting Port Scans

Port scans produce distinctive packet patterns:

SYN scan (half-open scan):

# Attacker sends SYN to many ports, never completes handshake
# Wireshark filter:
tcp.flags.syn == 1 && tcp.flags.ack == 0

# Pattern: one SYN packet to each port, no response or RST response
# High volume of SYN packets from a single source to many ports = SYN scan

Connect scan (full handshake):

# Attacker completes the three-way handshake on each port
# Pattern: SYN → SYN-ACK → ACK → RST (immediate close)
# Look for: many short-lived connections from a single source

NULL/FIN/Xmas scans:

# Attacks that send packets with unusual flag combinations to evade detection
# NULL: no flags set
# FIN: only FIN flag set
# Xmas: FIN, PSH, URG flags set (like a Christmas tree)

# Wireshark filter for unusual flag combinations:
tcp.flags == 0x001    # FIN only
tcp.flags == 0x000    # NULL (no flags)
tcp.flags == 0x029    # Xmas (FIN+PSH+URG)

Detection: A single source IP sending SYN packets to hundreds of ports within seconds is almost certainly a port scan. Use Wireshark's Statistics → Conversations to see which source IP has the most connections.

Detecting ARP Spoofing

ARP spoofing produces a distinctive pattern: multiple IP addresses mapped to the same MAC address.

# Wireshark filter for ARP traffic
arp

# Look for:
# 1. Multiple ARP replies from the same MAC address claiming different IPs
# 2. Gratuitous ARP replies (ARP reply without a preceding request)
# 3. ARP replies where the sender MAC differs from the Ethernet source MAC

# Wireshark filter for gratuitous ARP:
arp.opcode == 2    # ARP reply (opcode 2) without a request

Detection: In the packet list, look for ARP replies where the same MAC address appears as the sender for multiple IP addresses. This indicates the ARP spoofer is claiming to be multiple devices.

Detecting Data Exfiltration

Data exfiltration through network traffic shows several patterns:

Large outbound transfers:

# Use Statistics → Conversations to find the largest data transfers
# Look for: a single internal host sending large amounts of data to an external IP

# Filter for large packets:
frame.len > 10000

DNS tunneling:

# Filter for DNS queries with long subdomain names:
dns.qry.name.len > 50

# Filter for TXT record queries (rare in normal traffic):
dns.qtype == 16

# Look for: high volume of DNS queries from a single host to the same domain

Periodic beaconing:

# Command-and-control traffic often shows regular intervals
# Use Statistics → I/O Graph to visualize traffic over time
# Look for: regular spikes at consistent intervals (e.g., every 60 seconds)

Protocol Hierarchy and Conversations

Statistics → Protocol Hierarchy shows the breakdown of traffic by protocol. A sudden increase in an unusual protocol (e.g., ICMP, Teredo, or a proprietary protocol) may indicate tunneling or malware communication.

Statistics → Conversations shows all communication pairs (who talked to whom, how much data, how long). For security analysis:

1. Sort by bytes — the largest transfers may indicate exfiltration
2. Sort by duration — long-lived connections may indicate persistent access
3. Look for internal hosts communicating with unexpected external IPs
4. Look for internal hosts communicating with each other on unusual ports (lateral movement)

Practical Investigation Workflow

When investigating a security incident with Wireshark:

1. Start with the timeline: When did the incident occur? Filter to that time window.

2. Identify the involved hosts: Filter by the affected IP addresses.

3. Follow the TCP streams: Reconstruct the application-layer conversations to see what data was transmitted.

4. Look for anomalies: Use Expert Info to find errors, retransmissions, and unusual patterns.

5. Correlate with other data: Compare packet findings with firewall logs, EDR alerts, and authentication logs.

6. Document findings: Export specific packets (File → Export Specified Packets) as evidence.