Protocol analysis with tshark
Inspecting HTTP, DNS and TLS traffic on the command line.
Level 201 · 16 lessons · 15 practice labs
Lessons
Capturing and filtering
- Capturing with tshark: You learn to capture traffic from the command line with tshark in your own lab and save the result to a file.
- tshark capture filters and size limits: You will tell tshark’s -f capture filter from its -Y display filter and limit a capture by packets, time and file size.
- Display filters on the command line with tshark: You learn to use tshark display filters on the command line to show only the parts of captured traffic you care about, such as HTTP, DNS or TLS.
- Two-pass analysis and reassembly with tshark: -2 and -R
- Short task: record a filtered five-minute DNS and HTTP capture
Inspecting protocols
- Protocol hierarchy statistics with tshark: You learn to use tshark to see how protocols are distributed in a capture and to notice an unexpected or unusual one.
- Finding and following TCP streams with tshark: You learn to use tshark to find the whole conversation of a TCP connection, follow it from start to end, and understand what happened.
- Reconstructing HTTP requests and responses with tshark: You learn to rebuild an HTTP request and its response from a capture with tshark and see exactly what was sent and received.
- TLS handshake fields with tshark: SNI, version, cipher suite
- Short task: count every TLS server name in a capture
Field extraction and automation
- Extracting fields and CSV output with tshark: You learn to use tshark to pull fields such as source address and domain name out of a capture, put them in a CSV table and analyse them by counting.
- Hunting suspicious domains in DNS queries with tshark: From a defender's point of view you learn to use tshark to spot suspicious-looking domain names and unusual query patterns in DNS traffic.
- Automating the hunting workflow with tshark: You learn to put your repeated tshark hunting steps into a script so the same checks run quickly and consistently on every new capture.
- Conversation and interval statistics with tshark -z
- Short task: prepare a tshark summary script to run daily
- Capstone: report on suspicious traffic with tshark: In a task for a fictional company you use tshark to find suspicious behaviour in a traffic capture and write it up with evidence in a short report.
Practice labs
- A timed capture with tshark: Take a 60-second capture containing only DNS with tshark.
- Filter and save DNS and HTTP: Write only DNS and HTTP packets from a mixed capture to a new file.
- Reassembly with two-pass analysis: Filter fragmented responses correctly with two-pass analysis and compare with the incomplete single-pass result.
- Protocol hierarchy statistics: Produce a capture's protocol hierarchy and find the unexpected protocol.
- Rebuild an HTTP request and response: Rebuild the HTTP request and response of a given stream on the command line.
- The longest-running TCP stream: Sort the TCP streams in the capture by duration and summarise the contents of the longest.
- Extract fields to CSV: Write time, source, host and path for every HTTP request to a CSV file.
- Conversation statistics: Produce the capture's conversation statistics and find the internal host sending the most bytes.
- A daily summary script: Write a script that summarises top talkers, DNS names and TLS server names for a capture.
- Count the TLS server names: Extract every TLS server name in the capture and report the most frequent.
- Clients using an old TLS version: List the clients offering an old TLS version from the handshake fields.
- Report suspicious traffic with tshark: In the fictional Tarnova Logistics capture, report the suspicious host, its destination and the time window using tshark alone.
- A display filter on the command line: List only HTTP responses with error status codes in a capture.
- A size-limited capture: Set up a capture that stops at a file size limit and show that it stops.
- Hunting suspicious domain names: Extract DNS queries, score them by length, label count and NXDOMAIN ratio and report the suspicious domain and the host asking for it with evidence lines.
About this course
Inspecting HTTP, DNS and TLS traffic on the command line.
What you will learn
- Capturing and filtering
- Inspecting protocols
- Field extraction and automation
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.