Packet Analysis with Wireshark
Packet analysis is one of the most powerful skills for network troubleshooting. Wireshark lets you see exactly what's happening on the wire.
Why Packet Analysis?
- See the truth: What actually happened vs what you think happened
- Debug connectivity: Find where communication breaks down
- Security investigation: Spot suspicious traffic
- Protocol learning: Understand how protocols really work
- Performance issues: Find latency, retransmissions, drops
Getting Started
Capture Methods
| Method | Use Case |
|---|---|
| Ethernet interface | Wired traffic |
| Wi-Fi interface | Wireless traffic (may need monitor mode) |
| Loopback | Local traffic |
| tcpdump + Wireshark | Remote capture |
| SPAN/mirror port | Capture traffic from other devices |
Display Filters vs Capture Filters
| Type | When | Syntax |
|---|---|---|
| Capture Filter (BPF) | Before capture - reduces size | host 8.8.8.8 and port 443 |
| Display Filter | After capture - filters view | ip.addr == 8.8.8.8 && tcp.port == 443 |
Essential Display Filters
| Filter | Purpose |
|---|---|
ip.addr == x.x.x.x |
Traffic to/from IP |
tcp / udp / icmp |
Protocol filter |
tcp.port == 443 |
Specific port |
http / dns / tls |
Application protocols |
tcp.flags.syn == 1 && tcp.flags.ack == 0 |
SYN packets (connection attempts) |
tcp.analysis.retransmission |
TCP retransmissions |
dns.qry.name contains example |
DNS queries for domain |
tls.handshake.type == 1 |
TLS Client Hello |
Following a Conversation
Right-click a packet → Follow → TCP Stream (or HTTP Stream) to see the full conversation in readable form. Extremely useful for debugging HTTP, APIs.
Common Troubleshooting Scenarios
TCP Connection Issues
Look for: 1. SYN only, no SYN-ACK: Firewall blocking, server down 2. SYN, SYN-ACK, RST: Port closed, wrong service 3. Many retransmissions: Packet loss, congestion 4. TCP ZeroWindow: Receiver overwhelmed 5. Duplicate ACKs: Possible packet loss
DNS Issues
Filter: dns
- Check if queries are sent and responses received
- Look for NXDOMAIN (domain doesn't exist)
- Check response times
TLS/HTTPS Issues
Filter: tls
- Look at TLS handshake (ClientHello, ServerHello, Certificate)
- Check for handshake failures
- Look at SNI (Server Name Indication)
HTTP Issues
Filter: http
- Check status codes (200, 301, 302, 400, 401, 403, 404, 500)
- Look at request/response headers
- Check redirects
tcpdump CLI (Quick Captures)
# Capture on interface
sudo tcpdump -i eth0 -w capture.pcap
# Capture specific host
sudo tcpdump -i eth0 host 192.168.1.100 -w capture.pcap
# Capture HTTP traffic
sudo tcpdump -i eth0 port 80 -A
# Capture DNS
sudo tcpdump -i eth0 port 53
# Read capture
tcpdump -r capture.pcap
# Show with more detail
tcpdump -r capture.pcap -vvv
Analysis Workflow
- Define the problem: What's broken? When does it happen?
- Capture relevant traffic: Filter to reduce noise
- Find the failing transaction: Look for errors, retransmissions, resets
- Follow the stream: Understand full context
- Identify root cause: Apply layer-by-layer thinking
- Document findings: Save capture if needed
Tips & Tricks
- Use color rules: Wireshark colors help spot issues (TCP errors, retransmissions)
- Expert Info: Check Analyze → Expert Information for automatic issues
- Statistics: Use Statistics menu for flows, endpoints, protocols
- Time display: Change to "Seconds Since Previous Captured Packet" to see gaps
- Save filters: Create bookmarks for common filters
- Decrypt TLS: Possible with session keys or pre-master secrets (for debugging)
Related Notes
- OSI TCPIP Models — Understanding layers
- IP TCP UDP — TCP analysis
- DNS DHCP ICMP — DNS/ICMP analysis
- Troubleshooting Scenarios — Practice exercises
Sources
- Wireshark Official Documentation (wireshark.org)
- Wireshark User's Guide
- Chappell, L. - Wireshark Network Analysis
- Sanders, C. - Practical Packet Analysis