The Wireshark interface: packet list, details, bytes; columns and profiles
You open an office capture, learn what the three panes (packet list, packet details, bytes) show, find specific packets and fields, create your own analyst profile with columns and a name-resolution setting, and at the end work out the client’s identity and the TLS server names yourself. The capture differs in every lab.
Level 101 · 45 min
Today a workstation’s 15 minutes of traffic came to the SOC for review: ~/captures/ofis.pcapng. Your team lead first wants you to be comfortable with the Wireshark window: "If you can’t find what you’re looking for, you work for the tool instead of the tool working for you."
The Wireshark window has three panes. Analogy: a library. The packet list is the list of books on the shelves (each line is a packet); the packet details are the table of contents of the book you picked (layers and fields); the bytes are the pages themselves (hexadecimal numbers and characters). The figure shows the three panes.
Wireshark’s menus are in English; that is how you use them at work too. I give menu paths as View > ....
What you will do in this lesson
- Open the capture
- The packet list: find a request
- Packet details: the layers
- The bytes pane: a file signature
- Your own profile: SOC-Analist
- Turn a field into a column
- Names instead of addresses: name resolution
- Who is the client?
- The names of the encrypted connections
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Finding a specific packet in the packet list
- Reading layers and fields in the packet details
- Recognising file signatures in the bytes pane
- Creating a Wireshark configuration profile
- Adding a field as a column
- Turning on name resolution and knowing its limits
← Wireshark install and capture permissions · Wireshark fundamentals · Wireshark coloring rules →
Start for free