What Is Wireshark Network Analysis Essential Guide

Published

Table of Contents

Wireshark stands as the gold standard for network traffic analysis, offering unparalleled visibility into packet-level interactions across diverse protocols. As a versatile tool, it empowers network administrators, cybersecurity professionals, and developers to troubleshoot connectivity issues, detect security threats, and optimize protocol performance with precision.

The software dissects network traffic at multiple OSI layers—particularly Layer 2 (Data Link) and Layer 3 (Network)—providing structured insights into Ethernet frames, IPv4/IPv6 packets, and TCP/UDP segments. Beyond its core functionality, Wireshark integrates advanced filtering, real-time visualization, and protocol-specific deep dives, making it indispensable for both routine diagnostics and forensic investigations. Its open-source nature further enhances accessibility, while its compatibility with alternatives like tcpdump and TShark ensures flexibility in deployment scenarios.

what is wireshark

Wireshark Core Concepts and Purpose in Network Traffic Analysis

Wireshark is a widely adopted open-source protocol analyzer that enables deep inspection of network traffic by capturing and decoding packets in real time. Its primary purpose lies in troubleshooting connectivity issues, diagnosing performance bottlenecks, investigating security incidents, and developing or testing network protocols. Unlike generic monitoring tools, Wireshark provides granular visibility into packet structures, protocol interactions, and anomalies at multiple layers of the OSI model, making it indispensable for network administrators, cybersecurity analysts, and developers.

The tool operates by intercepting raw network traffic through interfaces (e.g., Ethernet, Wi-Fi, or virtual adapters) and dissecting packets according to predefined protocol hierarchies. Its strength stems from the ability to correlate Layer 2 (Data Link) details—such as MAC addresses, VLAN tags, and frame checksums—with Layer 3 (Network) information like IP addresses, TTL values, and fragmentation flags. This dual-layer focus ensures accurate identification of issues ranging from misconfigured switches to IP spoofing attacks.

Packet Capture and Processing Mechanism at OSI Layers

Wireshark captures packets at the Data Link Layer (Layer 2) by leveraging libpcap (Linux) or WinPcap (Windows) libraries, which provide low-level access to network interfaces. Once captured, packets are parsed and reassembled into higher-layer protocols (e.g., TCP, UDP, HTTP) using a modular dissector engine. The OSI model layers most relevant to Wireshark’s functionality include:

- Layer 2 (Data Link): Handles framing, MAC addressing, and error detection. Wireshark captures raw frames, including Ethernet II headers, 802.11 Wi-Fi frames, and PPP encapsulations. Key metrics at this layer include:

  • Source/Destination MAC addresses (e.g., `00:1A:2B:3C:4D:5E`).
  • Frame type (e.g., ARP, IPv4, IPv6).
  • VLAN tags (if present in 802.1Q frames).
  • Frame Check Sequence (FCS) errors indicating physical layer corruption.
  • Layer 3 (Network): Focuses on logical addressing and routing. Wireshark decodes IP headers to extract:
    • Source/Destination IP addresses (e.g., `192.168.1.100`).
    • Time-to-Live (TTL) values for path analysis.
    • Protocol fields (e.g., `06` for TCP, `17` for UDP).
    • Fragmentation flags (e.g., `MF` for "More Fragments").
    The tool’s dissectors further break down encapsulated protocols (e.g., TCP segments into HTTP requests) using a hierarchical tree view, where each packet’s structure is visually represented with collapsible branches. For example, a TCP packet may display:

    Frame 1: 146 bytes on wire (1168 bits), 146 bytes captured (1168 bits)
    Ethernet II, Src: Cisco_1a:2b:3c (00:1A:2B:3C:4D:5E), Dst: Dell_6f:7g:8h (00:10:18:6F:7G:8H)
    Internet Protocol Version 4, Src: 192.168.1.1, Dst: 10.0.0.5
    Transmission Control Protocol, Src Port: 54321, Dst Port: 80, Seq: 1, Ack: 1, Len: 64
    Hypertext Transfer Protocol
    GET /api/data HTTP/1.1
    Host: example.com

    Comparison of Wireshark with Alternative Packet Analyzers

    While Wireshark dominates as a user-friendly GUI-based analyzer, alternative tools cater to specific use cases. The following table contrasts Wireshark with tcpdump and TShark (Wireshark’s CLI counterpart) across key metrics:
    Metric Wireshark tcpdump TShark
    User Interface Graphical (GTK-based), interactive filters, multi-pane views. Command-line only; output limited to terminal or pipe redirection. CLI with Wireshark’s full dissector engine; supports real-time display.
    Ease of Use Beginner-friendly with drag-and-drop, color-coding, and expert info. Steep learning curve; requires manual filter syntax (e.g., `tcpdump -i eth0 port 80`). Moderate; leverages Wireshark’s filters (e.g., `tshark -f "tcp port 443"`).
    Real-Time Analysis Supports live capture with dynamic filtering and statistics (e.g., IO Graph). Limited to terminal output; no built-in statistics or visualization. Full real-time capabilities with Wireshark’s GUI-like features in CLI.
    Protocol Support Extensive; includes proprietary protocols (e.g., VoIP, DNSSEC) via plugins. Basic; relies on libpcap for capture but lacks advanced dissectors. Identical to Wireshark; supports all dissectors and custom plugins.
    Export Formats Multiple (PCAP, PCAPNG, CSV, JSON, XML, plaintext). PCAP/PCAPNG only; output must be post-processed for readability. Same as Wireshark; adds CLI-specific formats (e.g., `-T fields` for structured output).
    Use Case Fit Troubleshooting, security forensics, protocol development. Scripting, automated monitoring, log analysis. Automated analysis, large-scale captures, integration with tools like Zeek.
    Key Considerations:
  • tcpdump excels in lightweight, scriptable environments where GUI overhead is undesirable (e.g., embedded systems or cron jobs).
  • TShark bridges the gap between tcpdump’s efficiency and Wireshark’s depth, ideal for automated pipelines (e.g., parsing captures with `-T json`).
  • Wireshark’s GUI is unmatched for interactive debugging, though its resource usage may be prohibitive on low-end devices.

    • Installation of Wireshark on Linux (Ubuntu/Debian)

    Installing Wireshark on Ubuntu/Debian requires adding the official repository to ensure access to the latest stable version and dependencies. The process involves verifying system prerequisites, updating package lists, and installing the tool with proper permissions.

    Prerequisites:

  • A non-root user with `sudo` privileges.
  • libpcap (for packet capture) and GTK3 (for GUI) libraries pre-installed on most Debian-based systems.
  • Internet connectivity to fetch packages from the Wireshark repository.

    • Step-by-Step Installation:
    1. Add the Wireshark repository and import the GPG key:

    sudo apt update
    sudo apt install -y software-properties-common
    sudo add-apt-repository ppa:wireshark-dev/stable
    wget -qO - https://www.wireshark.org/wireshark.key | sudo apt-key add -

    Expected Output:

    Adding repository: 'deb http://ppa.launchpad.net/wireshark-dev/stable/ubuntu focal main'
    OK
    OK: Added repository 'https://ppa.launchpad.net/wireshark-dev/stable/ubuntu'

    2. Update the package list and install Wireshark:

    sudo apt

    what is wireshark - Ilustrasi 2

    Technical Workflow: Packet Capture and Filtering in Wireshark

    Wireshark’s core functionality revolves around capturing, analyzing, and filtering network traffic in real time or from stored sessions. The workflow begins with selecting a network interface for live capture, applying capture filters to isolate relevant traffic, and dissecting packets to extract meaningful data. Post-capture, display filters refine the analysis, enabling users to focus on specific protocols, payloads, or anomalies. This process is foundational for troubleshooting, security analysis, and performance optimization in network environments.

    The technical execution of packet capture involves configuring Wireshark to monitor traffic on a chosen interface while applying granular filters to reduce noise. Once captured, packets are dissected into hierarchical layers—from physical (Frame) to application (e.g., HTTP, DNS)—where each field provides insights into protocol behavior, errors, or payload content. Advanced filtering extends this capability, allowing analysts to query traffic dynamically or export structured data for further processing.

    Initiating a Live Packet Capture

    To begin capturing live traffic, Wireshark requires an active network interface and appropriate permissions to access it. The process involves:
    1. Selecting an Interface: Open Wireshark and choose the network adapter (e.g., Ethernet, Wi-Fi) from the interface list. Interfaces marked with a green arrow are typically active and ready for capture.
    2. Configuring Capture Settings: Adjust parameters such as Promiscuous Mode (to capture all traffic on the network segment) or Snap Length (to limit packet size for storage efficiency).
    3. Applying Capture Filters: Use capture filters (e.g., `tcp port 80`) to restrict traffic to specific protocols, ports, or IP addresses before it is stored. These filters are applied via the Capture > Options menu or the toolbar filter field.
    4. Starting the Capture: Click the blue shark fin button to begin capturing packets. The capture window updates in real time, displaying packets as they arrive.
    5. Saving the Session: After capturing, save the session in `.pcap` or `.pcapng` format (File > Save) for offline analysis. The `.pcapng` format supports additional metadata and compression.

    Example Capture Filter:

    `tcp port 80 and ip.addr == 192.168.1.100`
    Explanation: Captures only TCP traffic on port 80 (HTTP) where the source or destination IP is `192.168.1.100`.

    Anatomy of the Wireshark Packet Dissection Window

    Wireshark’s packet dissection window organizes captured data into three primary columns:
  • No.: Packet sequence number for tracking order.
  • Time: Timestamp of packet arrival (relative to the first packet or absolute UTC).
  • Source → Destination: Protocol-specific address fields (e.g., MAC, IP, port).

    • Each packet is dissected into hierarchical layers, with key fields including:

  • Frame: Physical layer details, such as Ethernet header (e.g., Ethernet II), frame length, and checksum errors.
  • Example Fields: Destination/MAC Address, Source/MAC Address, Protocol Type (e.g., `0x0800` for IPv4).
  • IPv4: Network layer information, including:
  • Source/Destination IP, Protocol (e.g., `TCP`, `UDP`), Type of Service (ToS), and flags (e.g., `DF` for Don’t Fragment).
  • TTL (Time To Live): Indicates hop count; a TTL of 1 suggests local traffic.
  • TCP: Transport layer details, such as:
  • Source/Destination Port, Sequence/Acknowledgment Numbers, Flags (e.g., `SYN`, `ACK`, `FIN`), and Window Size.
  • Payload: Application-layer data (e.g., HTTP headers, encrypted payloads).

    • Visual Hierarchy:

    A packet’s dissection follows the OSI model, with each layer expanding to reveal subfields. For example:

    Frame 1: 100 bytes on wire (802.1Q), 100 bytes captured
    Ethernet II, Src: 00:11:22:33:44:55, Dst: aa:bb:cc:dd:ee:ff
    Protocol type: IPv4 (0x0800)
    Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.100
    Protocol: TCP (6)
    Transmission Control Protocol, Src Port: 443, Dst Port: 54321, Seq: 1, Ack: 1, Len: 0
    Flags: [SYN]

    Advanced Capture Filters

    Capture filters in Wireshark use a syntax derived from libpcap, enabling precise traffic isolation before storage. These filters reduce disk usage and focus analysis on critical data. Common operators include:
  • Logical Operators: `and`, `or`, `not` (case-insensitive).
  • Comparators: `==`, `!=`, `>`, `<`.
  • Protocol-Specific Fields: `tcp.port`, `udp.dstport`, `ip.addr`, `http.host`.

    • Advanced Filter Examples:

    • IP Address and Port Combination:
      `ip.addr == 192.168.1.1 && tcp.port == 443`
      Use Case: Capture HTTPS traffic (TCP port 443) involving a specific IP, useful for monitoring SSL/TLS encrypted sessions.
    • Protocol and Payload Matching:
      `tcp.port == 22 and string contains "ssh"`
      Use Case: Filter SSH traffic containing the substring "ssh" in the payload, often used to detect brute-force attempts.
    • Broadcast and Multicast Traffic:
      `ether broadcast or ether multicast`
      Use Case: Isolate broadcast/multicast traffic (e.g., ARP, DHCP, or IoT protocols like Zigbee) for network segmentation analysis.
    • ICMP and Error Detection:
      `icmp.type == icmp-dst-unreachable`
      Use Case: Capture ICMP "Destination Unreachable" messages to identify routing or firewall blocks.
    • Time-Based Filtering:
      `frame.time_delta > 1.0`
      Use Case: Detect latency spikes by capturing packets with inter-arrival times exceeding 1 second.
    Note: Capture filters are applied before packets are stored, unlike display filters, which operate on already captured data.

    Applying Display Filters and Exporting Filtered Data

    Display filters refine captured traffic after the session is saved, allowing dynamic analysis without recapturing. These filters use a more extensive syntax, including protocol-specific fields (e.g., `http.request.method`) and regular expressions. To apply a display filter:
    1. Enter the filter in the filter toolbar (e.g., `tcp.port == 80 and http`).
    2. Press Enter to apply it. Only matching packets remain visible.
    3. Right-click a packet or selected packets to Follow TCP Stream, Export Objects, or Apply as Filter.

    Common Display Filter Examples:

    • HTTP Method Filtering:
      `http.request.method == "POST"`
      Use Case: Isolate HTTP POST requests, critical for analyzing form submissions or API calls.
    • DNS Query Analysis:
      `dns.qry.name contains "google.com"`
      Use Case: Track DNS queries for a specific domain to detect misconfigurations or DNS tunneling.
    • TCP Retransmissions:
      `tcp.analysis.retransmission`
      Use Case: Identify retransmitted TCP segments, indicating network congestion or packet loss.
    • Payload-Based Filtering:
      `frame contains "404 Not Found"`
      Use Case: Locate HTTP error responses for debugging broken links or server misconfigurations.
    Exporting Filtered Data to CSV:
    To export filtered packets for further analysis (e.g., in Excel or Python):
    1. Apply the desired display filter.
    2. Right-click the packet list and select Export Specified Packets.
    3. Choose CSV as the format and select fields (e.g., `No.`, `Time`, `Source`, `Destination`, `Protocol`

    Security Applications: Detecting Anomalies and Threats with Wireshark

    Wireshark serves as a critical tool in network security by enabling analysts to detect malicious activities through deep packet inspection (DPI) and traffic pattern analysis. Its ability to dissect protocol layers, identify irregularities in packet sequences, and reconstruct application-layer conversations makes it indispensable for threat detection. Security professionals leverage Wireshark to uncover attacks such as ARP spoofing, denial-of-service (DoS) floods, and session hijacking by examining deviations from expected network behavior, including unusual source/destination IPs, malformed flags, or abnormal traffic volumes.

    The tool’s analytical capabilities extend beyond raw packet capture, incorporating statistical visualizations and stream reassembly to quantify and contextualize suspicious activity. By integrating Wireshark’s built-in graphs, protocol hierarchies, and stream reconstruction features, analysts can systematically isolate threats and prioritize investigative efforts.

    Identifying Common Network Attacks via Packet Pattern Analysis

    Wireshark detects network attacks by analyzing deviations in packet structures, sequences, and metadata that violate standard communication protocols. For example:
  • ARP Spoofing: Identified by observing duplicate or conflicting ARP responses for the same IP address, often with inconsistent hardware (MAC) addresses. Wireshark’s Ethernet filter (`arp`) and Follow → ARP conversation feature reveal spoofed replies.
  • SYN Floods: Recognized by an excessive volume of TCP packets with the SYN flag set but no corresponding SYN-ACK or ACK responses. The Statistics → Protocol Hierarchy chart highlights disproportionate TCP traffic, while IO Graphs → TCP Stream Graph visualizes incomplete or abandoned connections.
  • Session Hijacking: Detected through unexpected sequence number resets or mid-stream packet injections. The TCP → Sequence/ACK Analysis tool in Wireshark flags anomalies in the TCP handshake or data stream continuity.

    • Analysts cross-reference these patterns with baseline traffic metrics (e.g., average packet rates, protocol distributions) to distinguish malicious activity from legitimate fluctuations. For instance, a sudden spike in ICMP echo requests (ping sweeps) or DNS queries to non-existent domains (DNS tunneling) can indicate reconnaissance or data exfiltration attempts.

    Wireshark’s Built-in IO Graphs for Visualizing Traffic Anomalies

    Wireshark’s IO Graphs module provides real-time visualizations of network traffic metrics, enabling analysts to spot anomalies such as bandwidth spikes, protocol misbehavior, or asymmetric traffic flows. Below is a table summarizing key IO graphs and their security applications:
    IO Graph Type Purpose Security Use Case Example Anomaly
    Flow Graph Displays traffic volume per conversation (source-destination pair) over time. Identifies sudden increases in traffic between specific hosts, potentially indicating data exfiltration or command-and-control (C2) communications. A single host sending 10x more data than usual to an external IP.
    TCP Stream Graph Tracks TCP connection states (SYN, SYN-ACK, FIN) and data transfer rates. Detects SYN floods or half-open connections by highlighting stalled or excessive SYN packets. Abnormal number of SYN packets with no corresponding ACKs in a short timeframe.
    Protocol Hierarchy Graph Shows percentage distribution of traffic by protocol (e.g., HTTP, DNS, TLS). Flags unusual protocol ratios (e.g., 80% DNS traffic when baseline is 5%) or unexpected encryption bypasses. Sudden rise in unencrypted HTTP traffic in a network predominantly using HTTPS.
    Endpoint Graph Visualizes traffic per source/destination IP or MAC address. Isolates malicious hosts engaging in port scanning or lateral movement. A previously inactive internal IP initiating connections to multiple external ports.
    Byte/Packet Rate Graph Monitors overall network throughput and packet counts. Identifies DoS attacks or bandwidth saturation by external actors. Spike in packet rate with no corresponding increase in bytes (indicative of small, malicious packets).
    To maximize effectiveness, analysts should:
  • Baseline normal traffic using historical IO graph data to establish thresholds for anomalies.
  • Combine graphs with filters (e.g., `ip.src == X.X.X.X && tcp.flags.syn == 1`) to isolate suspicious conversations.
  • Export graph data for further analysis in tools like Security Information and Event Management (SIEM) systems.

    • Reconstructing TCP Streams for Payload Inspection

    Wireshark’s stream reassembly feature allows analysts to reconstruct application-layer conversations (e.g., HTTP, DNS, SMTP) from fragmented or out-of-order packets. This capability is essential for inspecting payloads, uncovering hidden commands, or validating protocol compliance.

    Steps to Reconstruct and Inspect TCP Streams:
    1. Identify the Target Conversation:

  • Use the Filter bar to locate relevant traffic (e.g., `tcp.port == 80` for HTTP or `dns` for DNS queries).
  • Right-click a packet in the conversation and select Follow → TCP Stream (or UDP Stream for stateless protocols).

    • 2. Analyze Stream Context:

  • The stream window displays reassembled payloads in chronological order, including:
  • HTTP Requests/Responses: Inspect headers for unauthorized access attempts (e.g., `User-Agent` spoofing) or hidden data in `POST` bodies.
  • DNS Queries: Look for NXDOMAIN responses or queries to known malicious domains (e.g., `malware[.]example[.]com`).
  • Encrypted Traffic (TLS): Use Wireshark’s TLS decryption (if keys are available) or export PCAP files for offline decryption tools like `sslstrip` or `ssldump`.

    • 3. Validate Protocol Compliance:

  • Compare payloads against RFC standards (e.g., HTTP/1.1, DNS RFC 1035). Deviations may indicate:
  • Malformed packets (e.g., truncated HTTP headers).
  • Protocol abuse (e.g., DNS tunneling using non-standard record types).
  • Use the Analyze → Expert Info tool to flag protocol violations automatically.

    • 4. Export and Archive Streams:

  • Save stream data as a text file (`File → Export Objects → HTTP`) for forensic analysis or evidence retention.
  • For large streams, apply filters to extract specific payloads (e.g., `http.request.method == "POST"`).

    • Example Workflow for HTTP Traffic Analysis:

  • Filter: `http.request.method == "POST" && http.host contains "admin"`
  • Action: Follow the TCP stream to inspect the request body for credentials or unauthorized commands.
  • Finding: A POST request to `/login` with a base64-encoded payload may indicate credential stuffing or a web shell upload.

    • Quantifying Traffic Distribution with Protocol Hierarchy

    Wireshark’s Statistics → Protocol Hierarchy tool provides a percentage breakdown of traffic by protocol, enabling analysts to detect deviations from expected distributions. This metric is particularly useful for identifying:
  • Protocol Abuse: Unusual spikes in protocols like DNS or ICMP that may indicate tunneling or reconnaissance.
  • Encryption Bypass: A drop in HTTPS traffic with a rise in unencrypted HTTP, suggesting MITM attacks or misconfigured endpoints.
  • Lateral Movement: Internal protocols (e.g., SMB, RDP) dominating traffic when external protocols (e.g., HTTP) should prevail.

    • Steps to Interpret Protocol Hierarchy Data:
    1. Access the Hierarchy:

  • Navigate to Statistics → Protocol Hierarchy and select a time range (e.g., last 24 hours).
  • Sort by protocol to identify outliers (e.g., DNS > 40% of traffic).

    • 2. Compare Against Baselines:

  • Establish a baseline for normal traffic (e.g., 60% HTTP, 30% DNS, 5% TLS). Tools like NetFlow or sFlow can supplement Wireshark data.
  • Use Wireshark’s IO Graph → Protocol Hierarchy Graph for real-time visualization.

    • 3. Flag Suspicious Ratios

    what is wireshark - Ilustrasi 3

    Protocol-Specific Deep Dives: HTTP, DNS, and VoIP in Wireshark

    Wireshark’s ability to dissect protocol-specific traffic enables network analysts to diagnose performance bottlenecks, identify security vulnerabilities, and troubleshoot real-time communications. HTTP/HTTPS sessions reveal application-layer interactions, DNS queries expose infrastructure dependencies, and VoIP protocols decode multimedia streams. This section provides actionable insights into dissecting these protocols, including decryption techniques for encrypted traffic, malicious indicators, and quality diagnostics.

    Dissecting HTTP/HTTPS Sessions in Wireshark

    HTTP traffic in Wireshark is analyzed through the Hypertext Transfer Protocol dissector, which parses requests, responses, and headers. HTTPS traffic requires decryption via TLS/SSL keys to inspect payloads. Below is a step-by-step guide to capturing and interpreting HTTP/HTTPS sessions, including decryption.

    ### Step-by-Step HTTP/HTTPS Analysis
    1. Capture HTTP Traffic

  • Apply a capture filter to isolate HTTP traffic:

    • tcp port 80 or http

    - For HTTPS, use:

    tcp port 443 or tls

    - Ensure the capture includes ClientHello and ServerHello handshakes for TLS sessions.

    2. Interpreting HTTP Headers
    Wireshark displays HTTP headers in the HTTP protocol pane. Key headers include:

  • `Host`: Identifies the target domain (e.g., `Host: example.com`).
  • `User-Agent`: Browser/device fingerprint (e.g., `User-Agent: Mozilla/5.0 (Windows NT 10.0)`).
  • `Cookie`: Session identifiers (e.g., `Cookie: session_id=abc123`).
  • `Content-Type`: Request/response media type (e.g., `Content-Type: application/json`).
  • `Cache-Control`: Caching directives (e.g., `Cache-Control: no-store`).

    • Example of a Malicious Header Indicator:

    User-Agent:

    Indicates a potential Cross-Site Scripting (XSS) attack via user input.

    3. Decrypting HTTPS Traffic with TLS Keys
    To decrypt TLS-encrypted payloads:

  • Export the RSA Private Key from the server (e.g., `.pem` or `.key` file).
  • In Wireshark:
    • 1. Go to Preferences > Protocols > TLS.
    2. Under (Pre)-Master-Secret log filename, set a path (e.g., `tls_keys.log`).
    3. Restart the capture and replay the pcap with the key:

    (rsa,0x1234567890abcdef,1234567890abcdef1234567890abcdef)

    - Wireshark will now display decrypted HTTP/2 or HTTP/1.1 payloads.

    4. Analyzing HTTP/2 Traffic
    HTTP/2 uses multiplexed streams over a single TCP connection. In Wireshark:

  • Filter for HTTP/2:

    • http2

    - Examine `:method`, `:path`, and `:scheme` pseudo-headers.

  • Look for HEADERS and DATA frames to reconstruct requests/responses.

    • DNS Traffic Analysis and Malicious Indicators

    DNS queries and responses in Wireshark are dissected via the Domain Name System (DNS) dissector. This protocol resolves domain names to IP addresses and vice versa, making it critical for infrastructure analysis. Below are key DNS record types and how Wireshark displays them, including indicators of DNS tunneling and malicious activity.

    ### DNS Record Types and Wireshark Display
    DNS queries/responses in Wireshark appear under the DNS protocol pane, with the following record types commonly analyzed:

    - A (Address): Maps a domain to an IPv4 address (e.g., `example.com → 93.184.216.34`).

  • AAAA (IPv6 Address): Maps a domain to an IPv6 address (e.g., `example.com → 2606:2800:220:1:248:1893:25c8:1946`).
  • MX (Mail Exchange): Specifies mail servers (e.g., `example.com → mail.example.com`).
  • CNAME (Canonical Name): Alias for another domain (e.g., `www.example.com → example.com`).
  • TXT (Text): Stores arbitrary text (e.g., SPF records, `v=spf1 include:_spf.example.com`).
  • NS (Name Server): Authoritative DNS servers (e.g., `example.com → ns1.example-dns.com`).
  • SOA (Start of Authority): Zone authority details (e.g., primary NS, refresh interval).

    • Example DNS Query/Response in Wireshark:

    DNS Query:
    Name: example.com
    Type: A
    Class: IN

    DNS Response:
    Name: example.com
    Type: A
    Class: IN
    TTL: 3600
    Length: 4
    A Record: 93.184.216.34

    ### Detecting Malicious DNS Tunneling
    DNS tunneling abuses DNS queries to exfiltrate data or bypass firewalls. Indicators in Wireshark include:

    - Unusual DNS Query Patterns:

  • High volume of A/AAAA queries to non-standard domains (e.g., `random123.xyz`).
  • Long TXT records (e.g., base64-encoded data in `TXT` fields).
  • Frequent NXDOMAIN responses (used to encode binary data).

    • - Example of DNS Tunneling Traffic:

    DNS Query:
    Name: a1.b2.c3.d4.e5.f6.g7.h8.i9.j0.k1.l2.m3.n4.o5.p6.q7.r8.s9.t0.u1.v2.w3.x4.y5.z6.example-tunnel.com
    Type: TXT
    DNS Response:
    TXT: "U2FsdGVkX1+..." (Base64-encoded payload)

    - Mitigation: Block outbound queries to suspicious domains or implement DNS sinkholing.

    VoIP Protocol Decoding: SIP, RTP, and Quality Diagnostics

    VoIP traffic in Wireshark is dissected via Session Initiation Protocol (SIP) for call setup and Real-time Transport Protocol (RTP) for media streams. Analysts use these protocols to extract call metadata, diagnose packet loss, and assess call quality.

    ### Decoding SIP and RTP in Wireshark
    1. SIP Call Metadata Extraction
    SIP messages (INVITE, 200 OK, BYE) contain:

  • Caller/Callee Identities (e.g., `From: `).
  • Call Duration (calculated from `INVITE` timestamp to `BYE`).
  • Codec Negotiation (e.g., `Content-Type: application/sdp` with `m=audio 5004 RTP/AVP 0` for G.711).

    • Example SIP INVITE:

    INVITE sip:1234@example.com SIP/2.0
    Via: SIP/2.0/UDP 192.168.1.100:5060
    From: "Alice" To: Call-ID: abc123@example.com
    CSeq: 1 INVITE
    Contact:

    2. RTP Stream Analysis
    RTP packets carry voice/video data. Key metrics in Wireshark:

  • Packet Loss: Filter for lost sequences (`rtp.seq` gaps).
  • Jitter: Variability in packet arrival times (`rtp.timestamp`).
  • Payload Type: Codec used (e.g., `0` = PCMU, `8` = PCMA).
  • SSRC (Synchronization Source): Identifies media streams.

    • Diagnosing Poor Call Quality:

  • High Packet Loss (>1%): Indicates network congestion or misconfigured QoS.
  • Jitter > 30ms: Causes choppy audio.
  • Out-of-Order Packets: Network path instability.

    • 3. VoIP Security Indicators

  • From identifying ARP spoofing attacks to reconstructing encrypted HTTP sessions or diagnosing VoIP quality degradation, Wireshark’s capabilities extend across critical use cases. Its ability to quantify traffic distribution, visualize anomalies through IO graphs, and export filtered data for further analysis underscores its role as a cornerstone in modern network management. By mastering Wireshark, professionals gain a powerful ally in maintaining secure, efficient, and high-performance networks in an increasingly complex digital landscape.

    • FAQ

    What is Wireshark used for?

    Wireshark is primarily used for network protocol analysis, allowing users to capture, inspect, and troubleshoot live network traffic in real time. It helps identify issues like latency, packet loss, or security threats by analyzing data packets at a granular level.

    What is Wireshark in cyber security?

    In cyber security, Wireshark is a powerful tool for detecting malicious activity by examining network traffic for anomalies, unauthorized access, or protocol violations. It’s often used for forensic analysis, penetration testing, and monitoring for intrusions or data exfiltration.

    What is Wireshark and why is it used?

    Wireshark is an open-source network protocol analyzer that lets users capture and interactively browse network packets. It’s used for debugging network issues, optimizing performance, and ensuring security by providing deep visibility into how data travels across networks.

    What is Wireshark in networking?

    In networking, Wireshark is a packet sniffer that captures and decodes network traffic to help administrators diagnose problems, monitor bandwidth usage, and analyze protocols like TCP/IP, HTTP, or DNS. It supports thousands of protocols and can filter traffic by various criteria.

    What is Wireshark software?

    Wireshark is a free, cross-platform software application designed for network traffic analysis, offering features like live capture, deep inspection of packets, and support for multiple file formats (e.g., PCAP). It’s widely used by IT professionals, developers, and security experts.

    What is Wireshark app?

    Wireshark is a desktop application (not a mobile app) for Windows, macOS, and Linux that provides advanced packet analysis capabilities. It includes a graphical user interface (GUI) and command-line tools (TShark) for capturing and analyzing network data.