728 cards
Wireshark is a widely used network protocol analyzer designed for troubleshooting, protocol development, education, and detailed inspection of network traffic. It captures packets from a live network interface or reads them from a saved capture file, then decodes the raw bytes into structured protocol layers that a hum...
Almost every protocol Wireshark can dissect has a short, intuitive filter name. The core transport and network protocols use just their names: tcp, udp, icmp, arp, ip, and ipv6 all work directly. Application-layer protocols are similarly concise, with filters such as http, tls, dns, dhcp, smtp, pop3, imap, ftp, ssh, sn...
Because TCP is connection-oriented and stateful, much of Wireshark's analytical power is devoted to inspecting TCP behavior. The six control flags — SYN, ACK, FIN, RST, PSH, and URG — can be tested individually with fields like tcp.flags.syn == 1, tcp.flags.ack == 1, tcp.flags.fin == 1, tcp.flags.rst == 1, tcp.flags.ps...
HTTP filtering is one of the most common tasks in Wireshark, and the http filter alone captures every HTTP packet. Requests can be narrowed further by method using http.request.method, with values like "GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS", "PATCH", "TRACE", and "CONNECT" corresponding to the standard HTTP...
Beyond individual packet filters, Wireshark provides a Statistics menu full of tools that summarize entire captures. The Protocol Hierarchy view (Statistics > Protocol Hierarchy) shows a tree of every protocol found in the capture along with packet counts, byte counts, and percentages, which is a quick way to see which...
Before capturing, the Capture > Options dialog controls how the trace is collected. The interface list shows every available network adapter, and the chosen interface determines which traffic can be observed. Promiscuous mode can be enabled there, instructing the driver to deliver every frame seen on the wire, not just...
Wireshark ships with a family of command-line companions that support scripted and remote workflows. TShark is the CLI counterpart to the GUI, capable of capturing with tshark -i eth0 -w output.pcapng, reading files with tshark -r input.pcapng, applying display filters via -Y, and emitting selected fields with -T field...