# Packet Analysis with Wireshark

Packet analysis is one of the most powerful skills for network troubleshooting. Wireshark lets you see exactly what's happening on the wire.

## Why Packet Analysis?

- **See the truth**: What actually happened vs what you think happened
- **Debug connectivity**: Find where communication breaks down
- **Security investigation**: Spot suspicious traffic
- **Protocol learning**: Understand how protocols really work
- **Performance issues**: Find latency, retransmissions, drops

## Getting Started

### Capture Methods
| Method | Use Case |
|---|---|
| **Ethernet interface** | Wired traffic |
| **Wi-Fi interface** | Wireless traffic (may need monitor mode) |
| **Loopback** | Local traffic |
| **tcpdump + Wireshark** | Remote capture |
| **SPAN/mirror port** | Capture traffic from other devices |

### Display Filters vs Capture Filters
| Type | When | Syntax |
|---|---|---|
| **Capture Filter** (BPF) | Before capture - reduces size | `host 8.8.8.8 and port 443` |
| **Display Filter** | After capture - filters view | `ip.addr == 8.8.8.8 && tcp.port == 443` |

## Essential Display Filters

| Filter | Purpose |
|---|---|
| `ip.addr == x.x.x.x` | Traffic to/from IP |
| `tcp` / `udp` / `icmp` | Protocol filter |
| `tcp.port == 443` | Specific port |
| `http` / `dns` / `tls` | Application protocols |
| `tcp.flags.syn == 1 && tcp.flags.ack == 0` | SYN packets (connection attempts) |
| `tcp.analysis.retransmission` | TCP retransmissions |
| `dns.qry.name contains example` | DNS queries for domain |
| `tls.handshake.type == 1` | TLS Client Hello |

## Following a Conversation

Right-click a packet → Follow → TCP Stream (or HTTP Stream) to see the full conversation in readable form. Extremely useful for debugging HTTP, APIs.

## Common Troubleshooting Scenarios

### TCP Connection Issues
Look for:
1. **SYN only, no SYN-ACK**: Firewall blocking, server down
2. **SYN, SYN-ACK, RST**: Port closed, wrong service
3. **Many retransmissions**: Packet loss, congestion
4. **TCP ZeroWindow**: Receiver overwhelmed
5. **Duplicate ACKs**: Possible packet loss

### DNS Issues
Filter: `dns`
- Check if queries are sent and responses received
- Look for NXDOMAIN (domain doesn't exist)
- Check response times

### TLS/HTTPS Issues
Filter: `tls`
- Look at TLS handshake (ClientHello, ServerHello, Certificate)
- Check for handshake failures
- Look at SNI (Server Name Indication)

### HTTP Issues
Filter: `http`
- Check status codes (200, 301, 302, 400, 401, 403, 404, 500)
- Look at request/response headers
- Check redirects

## tcpdump CLI (Quick Captures)

```bash
# Capture on interface
sudo tcpdump -i eth0 -w capture.pcap

# Capture specific host
sudo tcpdump -i eth0 host 192.168.1.100 -w capture.pcap

# Capture HTTP traffic
sudo tcpdump -i eth0 port 80 -A

# Capture DNS
sudo tcpdump -i eth0 port 53

# Read capture
tcpdump -r capture.pcap

# Show with more detail
tcpdump -r capture.pcap -vvv
```

## Analysis Workflow

1. **Define the problem**: What's broken? When does it happen?
2. **Capture relevant traffic**: Filter to reduce noise
3. **Find the failing transaction**: Look for errors, retransmissions, resets
4. **Follow the stream**: Understand full context
5. **Identify root cause**: Apply layer-by-layer thinking
6. **Document findings**: Save capture if needed

## Tips & Tricks

- **Use color rules**: Wireshark colors help spot issues (TCP errors, retransmissions)
- **Expert Info**: Check Analyze → Expert Information for automatic issues
- **Statistics**: Use Statistics menu for flows, endpoints, protocols
- **Time display**: Change to "Seconds Since Previous Captured Packet" to see gaps
- **Save filters**: Create bookmarks for common filters
- **Decrypt TLS**: Possible with session keys or pre-master secrets (for debugging)

## Related Notes

- [[Foundations/OSI-TCPIP-Models.md]] — Understanding layers
- [[Core-Protocols/IP-TCP-UDP.md]] — TCP analysis
- [[Core-Protocols/DNS-DHCP-ICMP.md]] — DNS/ICMP analysis
- [[Labs/Troubleshooting-Scenarios.md]] — Practice exercises

## Sources

* Wireshark Official Documentation (wireshark.org)  
* Wireshark User's Guide  
* Chappell, L. - *Wireshark Network Analysis*  
* Sanders, C. - *Practical Packet Analysis*