Analyzing Network Traffic with Wireshark
When to Use
- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement
- Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures
- Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts
- Validating firewall and IDS rules by confirming what traffic is actually traversing network segments
- Extracting files, credentials, or indicators of compromise from captured network sessions
Do not use to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.
Prerequisites
- Wireshark 4.0+ and tshark command-line utility installed
- Root/sudo privileges or membership in the
wiresharkgroup for live packet capture - Network interface access (physical NIC, span port, or network tap) to the monitored segment
- Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)
- Familiarity with TCP/IP protocols, HTTP, DNS, TLS, and SMB at the packet level
Workflow
Step 1: Configure Capture Environment
Set up the capture interface and filters to target relevant traffic:
For Wireshark GUI, set capture filter in the Capture Options dialog before starting.
Step 2: Apply Display Filters for Targeted Analysis
Step 3: Protocol-Specific Deep Analysis
Step 4: Extract Artifacts and IOCs
Step 5: Statistical Analysis and Anomaly Detection
Step 6: Generate Reports and Export Evidence
Key Concepts
Tools & Systems
- Wireshark 4.0+: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities
- tshark: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines
- tcpdump: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies
- mergecap: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis
- editcap: Wireshark utility for splitting, filtering, and converting between capture file formats
Common Scenarios
Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling
Context: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.
Approach:
- Capture traffic from the workstation's subnet using
tshark -i eth2 -f "host 10.10.3.45 and port 53" -w dns_exfil_investigation.pcapng - Analyze DNS query patterns:
tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.name contains \"suspect-domain.xyz\"" -T fields -e frame.time -e dns.qry.name - Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling):
tshark -r dns_exfil_investigation.pcapng -Y "dns.qry.type == 16" -T fields -e dns.qry.name -e dns.txt - Calculate data volume by summing query name lengths to estimate exfiltration bandwidth
- Extract unique query names and decode base64 subdomains to recover exfiltrated content
- Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody
Pitfalls:
- Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data
- Using display filters instead of capture filters, resulting in massive files that are slow to process
- Overlooking encrypted DNS (DoH/DoT) traffic that bypasses traditional DNS capture on port 53
- Failing to establish packet capture hash and chain of custody documentation for forensic evidence
