What is Wireshark?
Wireshark is the world’s most widely used network protocol analyzer.
It allows security analysts to capture live packets, inspect protocols,
detect anomalies, and perform network forensics.
Captured Packet Example
Frame 1024: 1514 bytes on wire
Ethernet II, Src: 00:1A:2B:3C:4D:5E, Dst: 08:00:27:AA:BB:CC
Internet Protocol Version 4, Src: 192.168.1.10, Dst: 192.168.1.1
Transmission Control Protocol, Src Port: 52344, Dst Port: 80
Hypertext Transfer Protocol
GET /login HTTP/1.1
Host: vulnerable-site.com
Cookie: PHPSESSID=4f7c92ab1d
Common Analysis Filters
http → Show only HTTP traffic
tcp.port == 80 → Filter port 80
ip.addr == 192.168.1.1 → Specific host
dns → DNS queries
tcp.flags.syn == 1 → SYN scan detection
Attack Phase Mapping
[ Packet Capture ] → Monitor raw network traffic
[ Protocol Analysis ] → Detect credentials, sessions
[ Forensics ] → Trace attacker movement & exfiltration
← Back to Tools
Home