Introduction

Wireshark is the world's foremost and widely-used network protocol analyzer. It lets you see what's happening on your network at a microscopic level. In this deep dive, we'll cover advanced techniques that go beyond basic packet capture.

Setting Up Capture Filters

Before capturing traffic, it's crucial to set up proper capture filters to reduce noise:

Capture only HTTP/HTTPS traffic
tcp port 80 or tcp port 443
Capture traffic from a specific subnet
net 192.168.1.0/24
Capture DNS queries only
udp port 53

Display Filters for Forensic Analysis

Once you have captured data, display filters help you isolate relevant packets:

Find HTTP POST requests (potential data exfiltration)
http.request.method == "POST"
Find DNS queries to suspicious TLDs
dns.qry.name contains ".xyz" or dns.qry.name contains ".top"
Detect potential C2 beaconing (regular interval connections)
tcp.flags.syn == 1 && tcp.flags.ack == 0

Identifying Malicious Traffic Patterns

1. DNS Tunneling Detection

2. Beaconing Analysis

3. Data Exfiltration Indicators

• Large outbound data transfers during off-hours
• Encrypted connections to non-standard ports
• HTTP POST requests with large payloads to unknown domains

Protocol Dissection

Wireshark's protocol dissectors allow deep inspection of application-layer protocols. Custom dissectors can be written in Lua for proprietary protocols.

TShark for Automated Analysis

For automated analysis pipelines, TShark (Wireshark's CLI) is invaluable:

Extract all HTTP URLs from a capture
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
Count connections per source IP
tshark -r capture.pcap -T fields -e ip.src | sort | uniq -c | sort -rn | head -20
Export specific streams
tshark -r capture.pcap -Y "tcp.stream eq 5" -w stream5.pcap

Best Practices

• Always capture with proper authorization — Unauthorized packet capture may violate laws
• Use ring buffers for continuous monitoring to avoid disk space issues
• Encrypt your captures as they may contain sensitive data
• Timestamp analysis is crucial for incident response timelines
• Combine with other tools like Zeek (Bro) for automated threat detection

Conclusion

Mastering Wireshark requires practice and understanding of network protocols. Start with your own lab environment, analyze known-good traffic first, then gradually move to more complex scenarios. The key is understanding what "normal" looks like so you can identify anomalies.