Beyond filtering and statistics, Wireshark offers a number of features that streamline in-depth analysis. Follow TCP Stream reconstructs the bidirectional byte stream of a session, presenting the raw data exchange between client and server as an ASCII or hex dump, with the option to filter the packet list to one direction or the other; this is the primary tool for understanding application-layer conversations. Follow Stream also works for UDP and other protocols, providing the same functionality wherever a stream-oriented dissector exists. Export Objects, reachable from File > Export Objects, extracts files transferred over protocols such as HTTP, SMB, and DICOM directly from a capture, eliminating the need for manual reconstruction. Color Coding visually categorises packets in the list pane by coloring them according to user-defined rules; the Coloring Rules editor supports import, export, and per-rule foreground and background colors. Name Resolution can be enabled for MAC addresses, network addresses, and transport names through View > Name Resolution, mapping IPs to hostnames and ports to service names.
Wireshark also provides several supporting features that improve productivity during long investigations. The Time Display Format setting controls how the timestamp column is rendered, with options including seconds since beginning, seconds since previous packet, UTC date and time, local date and time, and seconds since the Unix epoch. The packet list can be navigated with Go to Packet and Find Packet, and individual packets can be highlighted with Mark Packet or annotated with Packet Comments for documentation. Time References, set by right-clicking a packet, anchor subsequent time-delta calculations to a chosen packet, which is especially useful for measuring response times without writing filters. Profiles allow complete configurations of filters, colors, and preferences to be saved and switched, supporting distinct analysis setups for different tasks. Lua scripting support enables custom protocol dissectors and post-dissection analysis, with scripts loadable from the plugins directory or Preferences. The GeoIP feature, once configured with a MaxMind database, maps IP addresses to geographic locations for traffic origin studies.
The Wireshark suite includes a powerful set of command-line tools for scripted and remote analysis. TShark is the terminal counterpart to the GUI, capable of both capturing and reading captures, with options like -i for the interface, -r for reading a file, -Y for applying a display filter, and -T fields with -e selectors to extract specific fields. Dumpcap is the lightweight capture backend that both Wireshark and TShark rely on; it accepts options such as -i for the interface, -w for output, and -b filesize:N for ring-buffer file size. Editcap edits existing captures, supporting -c N to split files into chunks of N packets and -d to remove duplicates. Mergecap combines multiple capture files, and Capinfos reports metadata about a capture including format, size, duration, and packet counts. Reordercap sorts packets by timestamp, and Text2pcap converts hex dumps back into pcap files for analysis. Together, these tools enable headless workflows, automated analysis pipelines, and integration with other security tooling.
For security analysts, Wireshark is a powerful forensics and incident-response instrument. Reconnaissance and attack patterns can be isolated through filters such as tcp.flags.syn == 1 && tcp.flags.ack == 0 (SYN scans), small-window SYN volumes (potential SYN floods), and unusual fragmentation patterns. DNS-based threats are caught by suspicious query patterns, such as dns.qry.name matches against known dynamic-DNS or free-TLD domains. Credential leaks emerge in plaintext HTTP via http.authorization, especially in base64-encoded Basic authentication, while SQL injection patterns surface through http.request.uri matches against union, select, insert, delete, drop, and exec. ARP spoofing is detectable by watching for multiple MAC addresses claiming the same IP, and unauthorized services can be spotted by traffic on unexpected ports. Latency analysis leverages TCP Stream Graphs for round-trip time, I/O Graphs for throughput patterns, and Expert Info for retransmissions, duplicate ACKs, and zero-window events that collectively point to network congestion. Across all of these workflows, the disciplined use of display filters combined with the statistics suite and command-line tools transforms Wireshark from a packet viewer into a comprehensive platform for network troubleshooting, security monitoring, and forensic investigation.