Wireshark is the world's most popular network protocol analyser. It captures network packets in real time and displays them in a human-readable format, letting you inspect every byte of traffic between hosts. Security analysts, network engineers, and penetration testers use it daily to diagnose network issues and detect threats.
This guide takes you from installation through live capture, display filters, HTTP and DNS analysis, following TCP streams, extracting files from pcap captures, and identifying malware indicators in network traffic — all with real filter examples you can use immediately.
◈ Table of Contents
01 — WHAT IS WIRESHARK & HOW IT WORKS
BEGINNERWireshark uses pcap (on Linux/macOS) or Npcap (on Windows) to capture raw packets from network interfaces. It then dissects each packet through protocol dissectors that decode every layer — Ethernet, IP, TCP/UDP, and application-layer protocols like HTTP, DNS, and TLS.
- Capture engine — uses libpcap/Npcap to capture raw frames from NICs
- Protocol dissectors — decode 3000+ protocols automatically
- Display filters — filter the view without re-capturing packets
- Capture filters — limit what gets captured at the kernel level (BPF syntax)
- Stream analysis — reassemble TCP/UDP streams into readable conversations
- Statistics engine — conversations, endpoints, protocol hierarchy, I/O graphs
02 — INSTALLATION
BEGINNERWireshark is pre-installed on Kali Linux. On other systems, install from the official repository or wireshark.org. Root/admin privileges are needed to capture live traffic.
03 — CAPTURE INTERFACES & CAPTURE FILTERS
BEGINNERWhen you launch Wireshark, the Welcome screen shows all available network interfaces with a live traffic sparkline. Double-click any interface to start capturing. Capture filters (BPF syntax) are applied before packets enter Wireshark — they reduce overhead but can't be changed without restarting the capture.
- 1Open Wireshark → select your active interface (eth0, wlan0, Wi-Fi) — the one with the traffic sparkline
- 2Optionally enter a capture filter in the box (BPF syntax — see below)
- 3Click the blue shark fin button (or Ctrl+E) to start capturing
- 4Generate some traffic: browse a website, ping a host
- 5Click the red square to stop. Use File → Save As to save as
.pcapor.pcapng
Capture filters (BPF) run before packets reach Wireshark — use them to reduce file size during large captures. Display filters run after capture and can be changed anytime without losing data. Learn both: capture filters for performance, display filters for analysis.
04 — DISPLAY FILTERS — COMPLETE REFERENCE
BEGINNER → INTERMEDIATEDisplay filters use Wireshark's own filter language, which is different from BPF capture filters. They filter the packet list view in real time. The filter bar turns green for valid syntax, red for invalid, and yellow for dubious.
==(eq) — equals!=(ne) — not equals>(gt) — greater than<(lt) — less thancontains— string search in packet datamatches— regex match
05 — HTTP TRAFFIC ANALYSIS
INTERMEDIATEHTTP analysis is one of Wireshark's most powerful features. You can see every GET/POST request, response code, headers, and body — including credentials sent over unencrypted connections.
- 1Capture HTTP traffic or open a pcap file
- 2Go to File → Export Objects → HTTP
- 3See a list of all transferred files: images, scripts, executables, documents
- 4Select any file → Save to extract it from the pcap
- 5Use this to recover malware samples, documents, or credentials from captured traffic
06 — FOLLOWING TCP & UDP STREAMS
BEGINNERIndividual packets are hard to read in context. "Follow Stream" reassembles the full TCP or UDP conversation into a human-readable view, showing both sides of the exchange in colour — client (red) and server (blue).
- 1Filter to the traffic of interest:
httportcp.port == 22 - 2Right-click any packet in the conversation → Follow → TCP Stream
- 3A window opens showing the full conversation — red = client sent, blue = server response
- 4Use the dropdown at the bottom to switch between stream views: ASCII, Raw, Hex, C Arrays
- 5Click Close — Wireshark auto-applies a display filter to show only packets from that stream
Use Follow → UDP Stream for DNS, SNMP, and Syslog analysis. Use Follow → HTTP Stream for reassembled web requests including compressed or chunked bodies. For TLS traffic, configure the (Pre-)Master Secret log to decrypt it: Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename.
07 — DNS ANALYSIS
INTERMEDIATEDNS is a goldmine for security analysis — it reveals what hosts are communicating with, C2 beaconing patterns, DNS tunnelling, and domain generation algorithm (DGA) activity. Every hostname lookup appears in DNS traffic even if the subsequent connection is encrypted.
08 — DETECTING MALWARE IN NETWORK TRAFFIC
INTERMEDIATEMalware leaves distinctive patterns in network traffic. Knowing what to look for in Wireshark lets you quickly identify C2 communication, lateral movement, and data exfiltration in captured pcap files or live traffic.
| Indicator | Wireshark Filter | What It Suggests |
|---|---|---|
| Periodic beaconing | Check I/O graph for regular spikes to single IP | C2 heartbeat / RAT callback |
| DNS to random domains | dns.qry.name matches "[a-z]{12,}" | DGA malware (Emotet, Dridex pattern) |
| Large DNS queries | dns and frame.len > 512 | DNS tunnelling / data exfiltration |
| Non-standard ports | tcp.port == 4444 or tcp.port == 1337 | Reverse shells, C2 callbacks |
| Base64 in HTTP | http contains "==" | Encoded payload / data exfiltration |
| Executable downloads | http.response and http contains "MZ" | Malware dropper delivering PE file |
| POST to long random URI | http.request.method=="POST" and http.request.uri matches "[a-f0-9]{32}" | C2 check-in with victim UUID |
Practice with malware pcap samples from malware-traffic-analysis.net — a free repository of real malware traffic captures with exercises and answers. Open them in Wireshark and work through identifying the infection chain, C2 server, and exfiltrated data.
Only capture network traffic on networks you own or have explicit authorization to monitor. Unauthorized packet capture is illegal in most jurisdictions. Never capture traffic on corporate or public networks without written permission from the network owner.
◈ Stay Connected
Follow CyberHawk Threat Intel for network security tutorials, threat analysis, and professional SOC content.
"They can't exploit you if you are the Exploit."