Wireshark fundamentals
Capturing packets, filters and following a conversation.
Level 101 · 15 lessons · 18 practice labs
Lessons
- Wireshark install and capture permissions: You will install Wireshark, set up the permissions needed for capturing packets safely, and understand why not every user should be allowed to capture.
- The Wireshark interface: packet list, details, bytes; columns and profiles: You will know the packet list, details and raw bytes panes of Wireshark and learn to adjust the columns and profiles to your own work.
- Wireshark coloring rules: You will create, change and import coloring rules in Wireshark and use them to spot important or suspicious traffic at a glance.
- Live capture with Wireshark: You will learn to pick the right interface in Wireshark, capture live traffic on your own lab network, and know when to stop a capture.
- Saving PCAPNG in Wireshark: You will learn to save traffic captured in Wireshark as a PCAPNG file, name it sensibly, and store it carefully because it may contain sensitive data.
- Wireshark display filters: You will learn to use Wireshark display filters to show only the packets for a given address, protocol or port out of tens of thousands.
- Wireshark capture filters (BPF): You will learn to use Wireshark capture filters (BPF) to record only the traffic you need from the start, and how this differs from a display filter.
- Following a TCP stream in Wireshark: You will learn to turn a TCP conversation split into pieces into readable text in Wireshark, and see what unencrypted protocols leave exposed on the network.
- Telling encrypted (TLS) from cleartext traffic with Wireshark: You will tell HTTPS/TLS traffic from plain HTTP in Wireshark and see in your own lab network how information is exposed in unencrypted protocols.
- Filtering and watching DNS traffic with Wireshark: You will filter DNS queries and responses in Wireshark and learn to notice unusual domain lookups.
- Wireshark statistics: hierarchy, conversations, I/O: You will use Wireshark's protocol hierarchy, conversation and I/O graphs to get the big picture of traffic and notice unusual spikes.
- Exporting from Wireshark: You will learn to export packets, objects and tables from a Wireshark capture, and how to remove sensitive details before using them in a report.
- IPv6 and ICMPv6 traffic with Wireshark: You will capture and read IPv6 and ICMPv6 traffic in Wireshark and recognise extension headers and neighbour discovery.
- Wireshark: extracting fields with tshark: You will use tshark, the command-line tool that comes with Wireshark, to pull specific fields from a capture and review them in bulk with scripts.
- Capstone: find the suspicious traffic with Wireshark: In a fictional company's sample traffic capture you find unusual connections using Wireshark filters and explain in a short note what you saw and why it looks suspicious.
Practice labs
- Filter one IP's traffic: Use a display filter to separate the packets one host sent and received and report the count.
- Combine filters: and, or, not: Show all TCP traffic to one server except port 443 with a single filter.
- Filter by content: packets containing a password: Write a filter that finds packets whose payload contains a given word and show which conversation they belong to.
- Follow a TCP stream: Follow the stream of a web conversation to pull out the request and response in readable form.
- Export HTTP objects: Export the files downloaded in the capture and list their hashes.
- Find and prove the suspicious download: Find the suspicious file download in the fictional Zelvio office capture, export the file and report the source address.
- Protocol hierarchy: what is on the network: Find the three protocols carrying the most bytes in the capture from the protocol hierarchy window.
- A peak in the I/O graph: Find the time and cause of the traffic peak in the I/O graph.
- IPv6 and ICMPv6: neighbour discovery: Filter the neighbour discovery messages in the capture and list which device announces which address.
- DNS queries only: Write a filter that shows only DNS queries in the capture and find the most queried name.
- Save selected packets to a new PCAPNG: Save only the suspicious conversation's packets to a new file and confirm the packet count.
- Capture filter or display filter: Write a BPF capture filter and a display filter for the same target, apply both to the same lab traffic and prove with packet counts what the capture filter lost for good.
- Encrypted or cleartext: Say which of five conversations in the capture are encrypted and show how you can tell.
- Read the server name from a TLS handshake: Extract the server names from the handshakes of the encrypted conversations and list which host went to which site.
- The same site reached both encrypted and in clear: Find the host connecting to the same server over both HTTP and HTTPS and show what was exposed in the cleartext session.
- The busiest pair: Find the two hosts exchanging the most data with the conversations window.
- Find the top receiver in the endpoints window: Find the host receiving the most bytes in the endpoints window, apply it as a filter and say over which protocol it received them.
- Pick the odd one from the conversation table: Sort the conversations by duration, bytes and direction ratio to find the long one-way conversation and explain it with packets.
About this course
In this course you learn to capture, filter and interpret network traffic with Wireshark. Lessons run on a real Kali desktop that opens in your browser: you start Wireshark yourself, arrange the interface, capture live traffic and examine capture files.
You start with the interface and filters and move on to following a TCP stream, telling encrypted from unencrypted traffic, reading DNS and IPv6 traffic, the statistics windows and extracting fields with tshark. The capture file of every lab is generated at random. In the final task you find the suspicious traffic in a capture on your own.
What you will learn
- Read the packet list, detail and byte panes; arrange columns and profiles
- Start a live capture, save it as PCAPNG and export from it
- Know the difference between display filters and capture filters (BPF) and write both
- Follow a TCP stream from start to end and read its content
- Tell encrypted (TLS) from unencrypted traffic; follow DNS queries and answers
- Summarise a capture with the protocol hierarchy, conversations and the I/O graph
- Extract fields from the command line with tshark
Who this course is for
For anyone who has to look at traffic as a SOC analyst, network administrator or security student. People who have never opened Wireshark can start from the beginning.
Prerequisites
Having heard of IP addresses, ports and TCP/UDP is enough. Some comfort with the Linux command line helps in the last lessons (tshark).
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Do I need to install Wireshark?
- No. Wireshark is ready on the Kali desktop that opens in your browser. Installation and capture permissions are explained in the first lesson, so you can also set it up on your own computer.
- What traffic do I examine? Real people’s traffic?
- No. All captures are sample traffic generated for the lab, and they change in every lab.
- Can I do it on a phone?
- The desktop opens on a phone too, but Wireshark is hard on a small screen. We recommend a computer for this course.
- I know little about networks. Can I still start?
- You can; every protocol is explained briefly inside the lesson. Going through Networking fundamentals alongside makes it easier.