Analyzing Network Traffic with Wireshark

When to Use

• Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement
• Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures
• Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts
• Validating firewall and IDS rules by confirming what traffic is actually traversing network segments
• Extracting files, credentials, or indicators of compromise from captured network sessions

Do not use to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.

Prerequisites

• Wireshark 4.0+ and tshark command-line utility installed
• Root/sudo privileges or membership in the wireshark group for live packet capture
• Network interface access (physical NIC, span port, or network tap) to the monitored segment
• Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)
• Familiarity with TCP/IP protocols, HTTP, DNS, TLS, and SMB at the packet level

Workflow

Step 1: Configure Capture Environment

Set up the capture interface and filters to target relevant traffic:

# List available interfaces
tshark -D

# Start capture on eth0 with a capture filter to limit scope
tshark -i eth0 -f "host 10.10.5.23 and (port 80 or port 443 or port 445)" -w /tmp/capture.pcapng

# Capture with ring buffer to manage disk usage (10 files, 100MB each)
tshark -i eth0 -b filesize:102400 -b files:10 -w /tmp/rolling_capture.pcapng

# Capture on multiple interfaces simultaneously
tshark -i eth0 -i eth1 -w /tmp/multi_interface.pcapng

For Wireshark GUI, set capture filter in the Capture Options dialog before starting.

Step 2: Apply Display Filters for Targeted Analysis