This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
Add this skill
npx mdskills install sickn33/wireshark-analysisComprehensive, structured analysis guide with extensive filters, workflows, and practical examples
1---2name: Wireshark Network Traffic Analysis3description: This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.4metadata:5 author: zebbern6 version: "1.1"7---89# Wireshark Network Traffic Analysis1011## Purpose1213Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.1415## Inputs / Prerequisites1617### Required Tools18- Wireshark installed (Windows, macOS, or Linux)19- Network interface with capture permissions20- PCAP/PCAPNG files for offline analysis21- Administrator/root privileges for live capture2223### Technical Requirements24- Understanding of network protocols (TCP, UDP, HTTP, DNS)25- Familiarity with IP addressing and ports26- Knowledge of OSI model layers27- Understanding of common attack patterns2829### Use Cases30- Network troubleshooting and connectivity issues31- Security incident investigation32- Malware traffic analysis33- Performance monitoring and optimization34- Protocol learning and education3536## Outputs / Deliverables3738### Primary Outputs39- Filtered packet captures for specific traffic40- Reconstructed communication streams41- Traffic statistics and visualizations42- Evidence documentation for incidents4344## Core Workflow4546### Phase 1: Capturing Network Traffic4748#### Start Live Capture49Begin capturing packets on network interface:5051```521. Launch Wireshark532. Select network interface from main screen543. Click shark fin icon or double-click interface554. Capture begins immediately56```5758#### Capture Controls59| Action | Shortcut | Description |60|--------|----------|-------------|61| Start/Stop Capture | Ctrl+E | Toggle capture on/off |62| Restart Capture | Ctrl+R | Stop and start new capture |63| Open PCAP File | Ctrl+O | Load existing capture file |64| Save Capture | Ctrl+S | Save current capture |6566#### Capture Filters67Apply filters before capture to limit data collection:6869```70# Capture only specific host71host 192.168.1.1007273# Capture specific port74port 807576# Capture specific network77net 192.168.1.0/247879# Exclude specific traffic80not arp8182# Combine filters83host 192.168.1.100 and port 44384```8586### Phase 2: Display Filters8788#### Basic Filter Syntax89Filter captured packets for analysis:9091```92# IP address filters93ip.addr == 192.168.1.1 # All traffic to/from IP94ip.src == 192.168.1.1 # Source IP only95ip.dst == 192.168.1.1 # Destination IP only9697# Port filters98tcp.port == 80 # TCP port 8099udp.port == 53 # UDP port 53100tcp.dstport == 443 # Destination port 443101tcp.srcport == 22 # Source port 22102```103104#### Protocol Filters105Filter by specific protocols:106107```108# Common protocols109http # HTTP traffic110https or ssl or tls # Encrypted web traffic111dns # DNS queries and responses112ftp # FTP traffic113ssh # SSH traffic114icmp # Ping/ICMP traffic115arp # ARP requests/responses116dhcp # DHCP traffic117smb or smb2 # SMB file sharing118```119120#### TCP Flag Filters121Identify specific connection states:122123```124tcp.flags.syn == 1 # SYN packets (connection attempts)125tcp.flags.ack == 1 # ACK packets126tcp.flags.fin == 1 # FIN packets (connection close)127tcp.flags.reset == 1 # RST packets (connection reset)128tcp.flags.syn == 1 && tcp.flags.ack == 0 # SYN-only (initial connection)129```130131#### Content Filters132Search for specific content:133134```135frame contains "password" # Packets containing string136http.request.uri contains "login" # HTTP URIs with string137tcp contains "GET" # TCP packets with string138```139140#### Analysis Filters141Identify potential issues:142143```144tcp.analysis.retransmission # TCP retransmissions145tcp.analysis.duplicate_ack # Duplicate ACKs146tcp.analysis.zero_window # Zero window (flow control)147tcp.analysis.flags # Packets with issues148dns.flags.rcode != 0 # DNS errors149```150151#### Combining Filters152Use logical operators for complex queries:153154```155# AND operator156ip.addr == 192.168.1.1 && tcp.port == 80157158# OR operator159dns || http160161# NOT operator162!(arp || icmp)163164# Complex combinations165(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443166```167168### Phase 3: Following Streams169170#### TCP Stream Reconstruction171View complete TCP conversation:172173```1741. Right-click on any TCP packet1752. Select Follow > TCP Stream1763. View reconstructed conversation1774. Toggle between ASCII, Hex, Raw views1785. Filter to show only this stream179```180181#### Stream Types182| Stream | Access | Use Case |183|--------|--------|----------|184| TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP |185| UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming |186| HTTP Stream | Follow > HTTP Stream | Web content, headers |187| TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) |188189#### Stream Analysis Tips190- Review request/response pairs191- Identify transmitted files or data192- Look for credentials in plaintext193- Note unusual patterns or commands194195### Phase 4: Statistical Analysis196197#### Protocol Hierarchy198View protocol distribution:199200```201Statistics > Protocol Hierarchy202203Shows:204- Percentage of each protocol205- Packet counts206- Bytes transferred207- Protocol breakdown tree208```209210#### Conversations211Analyze communication pairs:212213```214Statistics > Conversations215216Tabs:217- Ethernet: MAC address pairs218- IPv4/IPv6: IP address pairs219- TCP: Connection details (ports, bytes, packets)220- UDP: Datagram exchanges221```222223#### Endpoints224View active network participants:225226```227Statistics > Endpoints228229Shows:230- All source/destination addresses231- Packet and byte counts232- Geographic information (if enabled)233```234235#### Flow Graph236Visualize packet sequence:237238```239Statistics > Flow Graph240241Options:242- All packets or displayed only243- Standard or TCP flow244- Shows packet timing and direction245```246247#### I/O Graphs248Plot traffic over time:249250```251Statistics > I/O Graph252253Features:254- Packets per second255- Bytes per second256- Custom filter graphs257- Multiple graph overlays258```259260### Phase 5: Security Analysis261262#### Detect Port Scanning263Identify reconnaissance activity:264265```266# SYN scan detection (many ports, same source)267ip.src == SUSPECT_IP && tcp.flags.syn == 1268269# Review Statistics > Conversations for anomalies270# Look for single source hitting many destination ports271```272273#### Identify Suspicious Traffic274Filter for anomalies:275276```277# Traffic to unusual ports278tcp.dstport > 1024 && tcp.dstport < 49152279280# Traffic outside trusted network281!(ip.addr == 192.168.1.0/24)282283# Unusual DNS queries284dns.qry.name contains "suspicious-domain"285286# Large data transfers287frame.len > 1400288```289290#### ARP Spoofing Detection291Identify ARP attacks:292293```294# Duplicate ARP responses295arp.duplicate-address-frame296297# ARP traffic analysis298arp299300# Look for:301# - Multiple MACs for same IP302# - Gratuitous ARP floods303# - Unusual ARP patterns304```305306#### Examine Downloads307Analyze file transfers:308309```310# HTTP file downloads311http.request.method == "GET" && http contains "Content-Disposition"312313# Follow HTTP Stream to view file content314# Use File > Export Objects > HTTP to extract files315```316317#### DNS Analysis318Investigate DNS activity:319320```321# All DNS traffic322dns323324# DNS queries only325dns.flags.response == 0326327# DNS responses only328dns.flags.response == 1329330# Failed DNS lookups331dns.flags.rcode != 0332333# Specific domain queries334dns.qry.name contains "domain.com"335```336337### Phase 6: Expert Information338339#### Access Expert Analysis340View Wireshark's automated findings:341342```343Analyze > Expert Information344345Categories:346- Errors: Critical issues347- Warnings: Potential problems348- Notes: Informational items349- Chats: Normal conversation events350```351352#### Common Expert Findings353| Finding | Meaning | Action |354|---------|---------|--------|355| TCP Retransmission | Packet resent | Check for packet loss |356| Duplicate ACK | Possible loss | Investigate network path |357| Zero Window | Buffer full | Check receiver performance |358| RST | Connection reset | Check for blocks/errors |359| Out-of-Order | Packets reordered | Usually normal, excessive is issue |360361## Quick Reference362363### Keyboard Shortcuts364| Action | Shortcut |365|--------|----------|366| Open file | Ctrl+O |367| Save file | Ctrl+S |368| Start/Stop capture | Ctrl+E |369| Find packet | Ctrl+F |370| Go to packet | Ctrl+G |371| Next packet | ↓ |372| Previous packet | ↑ |373| First packet | Ctrl+Home |374| Last packet | Ctrl+End |375| Apply filter | Enter |376| Clear filter | Ctrl+Shift+X |377378### Common Filter Reference379```380# Web traffic381http || https382383# Email384smtp || pop || imap385386# File sharing387smb || smb2 || ftp388389# Authentication390ldap || kerberos391392# Network management393snmp || icmp394395# Encrypted396tls || ssl397```398399### Export Options400```401File > Export Specified Packets # Save filtered subset402File > Export Objects > HTTP # Extract HTTP files403File > Export Packet Dissections # Export as text/CSV404```405406## Constraints and Guardrails407408### Operational Boundaries409- Capture only authorized network traffic410- Handle captured data according to privacy policies411- Avoid capturing sensitive credentials unnecessarily412- Properly secure PCAP files containing sensitive data413414### Technical Limitations415- Large captures consume significant memory416- Encrypted traffic content not visible without keys417- High-speed networks may drop packets418- Some protocols require plugins for full decoding419420### Best Practices421- Use capture filters to limit data collection422- Save captures regularly during long sessions423- Use display filters rather than deleting packets424- Document analysis findings and methodology425426## Examples427428### Example 1: HTTP Credential Analysis429430**Scenario**: Investigate potential plaintext credential transmission431432```4331. Filter: http.request.method == "POST"4342. Look for login forms4353. Follow HTTP Stream4364. Search for username/password parameters437```438439**Finding**: Credentials transmitted in cleartext form data.440441### Example 2: Malware C2 Detection442443**Scenario**: Identify command and control traffic444445```4461. Filter: dns4472. Look for unusual query patterns4483. Check for high-frequency beaconing4494. Identify domains with random-looking names4505. Filter: ip.dst == SUSPICIOUS_IP4516. Analyze traffic patterns452```453454**Indicators**:455- Regular timing intervals456- Encoded/encrypted payloads457- Unusual ports or protocols458459### Example 3: Network Troubleshooting460461**Scenario**: Diagnose slow web application462463```4641. Filter: ip.addr == WEB_SERVER4652. Check Statistics > Service Response Time4663. Filter: tcp.analysis.retransmission4674. Review I/O Graph for patterns4685. Check for high latency or packet loss469```470471**Finding**: TCP retransmissions indicating network congestion.472473## Troubleshooting474475### No Packets Captured476- Verify correct interface selected477- Check for admin/root permissions478- Confirm network adapter is active479- Disable promiscuous mode if issues persist480481### Filter Not Working482- Verify filter syntax (red = error)483- Check for typos in field names484- Use Expression button for valid fields485- Clear filter and rebuild incrementally486487### Performance Issues488- Use capture filters to limit traffic489- Split large captures into smaller files490- Disable name resolution during capture491- Close unnecessary protocol dissectors492493### Cannot Decrypt TLS/SSL494- Obtain server private key495- Configure at Edit > Preferences > Protocols > TLS496- For ephemeral keys, capture pre-master secret from browser497- Some modern ciphers cannot be decrypted passively498
Full transparency — inspect the skill content before installing.