Wireshark is the primary tool for capturing, inspecting, and analyzing network traffic. It helps pentesters understand protocol behavior, investigate attacks, detect misconfigurations, and extract valuable information from packets. This chapter explains how Wireshark works, how to capture traffic effectively, how to filter and interpret packets, and how to analyze common protocols in pentesting.

Understanding Wireshark’s Role

Wireshark helps pentesters:

Capture live network traffic
Inspect protocol structures
Analyze HTTP, DNS, TCP, TLS, SMB, and more
Detect anomalies and suspicious behavior
Reconstruct sessions and files
Extract credentials (when unencrypted)
Investigate MITM attacks
Validate firewall and IDS behavior

Wireshark provides deep visibility into raw network activity.

Capture Basics

Wireshark captures packets from network interfaces.

Select an Interface

Open Wireshark and choose an interface such as:

eth0
wlan0
VPN interfaces
Virtual adapters

Start a Capture

Press Start to begin capturing.

Stop Capture

Press Stop when enough packets are collected.

Saving Captures

Save files as:

.pcap
.pcapng

These can be used later for offline analysis.

Display Filters for Efficient Analysis

Wireshark uses display filters to focus on specific traffic.

IP Filtering

ip.addr == 10.10.10.5

Filter by Protocol

http
dns
tcp
udp
tls

Filter by Port

tcp.port == 445
udp.port == 53

Filter by TCP Flags

Syn packets:

tcp.flags.syn == 1 && tcp.flags.ack == 0

Filter by HTTP Methods

http.request.method == "POST"

Filters allow fast, targeted inspection.

Analyzing the TCP Handshake

Traffic analysis often starts with TCP behavior.

Identify Handshake

Look for:

SYN
SYN/ACK
ACK

Filter:

tcp.flags.syn == 1

This reveals connection attempts and scanning behavior.

Identify Retransmissions and Errors

tcp.analysis.retransmission
tcp.analysis.flags

Packet errors help detect scanning, firewall filtering, or network issues.

HTTP Traffic Analysis

HTTP is often readable and reveals sensitive information.

Filter HTTP Requests

http.request

Inspect Headers

Common data:

Cookies
User-Agent
Authorization
Parameters

Extract POST Data

Selecting a POST packet reveals form submissions, credentials, or API calls.

Follow HTTP Stream

Right-click > Follow > HTTP Stream
This reconstructs full conversations.

DNS Traffic Analysis

DNS reveals domain lookups, tunneling, and MITM activity.

Filter DNS

dns

Key DNS Artifacts

Query names
Response IPs
NXDOMAIN loops
Long or encoded subdomains

These may reveal malware, tunneling, or reconnaissance.

TLS/SSL Traffic Analysis

TLS hides content but exposes metadata useful for forensics.

Filter TLS

tls

Inspect Client Hello

Look for:

TLS version
Cipher suites
SNI (server name indication)

Filter for SNI:

tls.handshake.extensions_server_name

Certificate Analysis

Check:

CN/SAN
Validity
Issuer
Internal hostnames

Weak TLS configurations reveal potential security issues.

SMB Traffic Analysis

SMB is common in internal networks and supports credential extraction.

Filter SMB

smb2

Identify SMB Negotiation

SMB traffic shows:

Usernames
Shares
Authentication attempts

Useful for lateral movement mapping.

Packet Dissection Techniques

Wireshark decodes layers in order:

Ethernet
IP
TCP/UDP
Application layer protocol

Inspect each layer for:

Flags
Ports
Payloads
Errors
Encoded data

The packet details pane provides structural breakdown.

Following Streams

Wireshark reassembles flows to show complete sessions.

TCP Stream

Right-click > Follow > TCP Stream

Useful for:

Login traffic
API exchanges
Chat protocols
Cleartext credentials

UDP Stream

Right-click > Follow > UDP Stream

Useful for:

DNS
RTP/VoIP
Custom UDP-based apps

Following streams reconstructs real conversation flows.

Reassembling Files From Traffic

Wireshark can rebuild files transferred across the network.

Export HTTP Objects

File > Export Objects > HTTP

Export SMB Objects

File > Export Objects > SMB

Downloadable files often include:

Malware
Documents
Scripts
Credentials

Detecting Reconnaissance & Scanning

Scan traffic shows patterns such as:

Half-open connections

tcp.flags.syn == 1 && tcp.flags.ack == 0

Rapid sequential SYNs

Indicates Nmap scanning.

DNS Bruteforce Patterns

Many DNS queries in short time.

Wireshark shows clear signatures of host discovery and port scanning.

MITM Detection

MITM attacks leave visible artifacts:

Duplicate ARP replies
Unexpected gateway MACs
SSL stripping
DNS spoofing responses
Sudden certificate changes

ARP Spoofing Filter

arp.duplicate-address-detected

Certificate Mismatch Detection

Compare serial numbers and issuers.

Extracting Credentials When Visible

Some protocols transmit credentials in cleartext.

HTTP Basic Auth

Authorization: Basic

FTP Logins

ftp.request.command == "USER"
ftp.request.command == "PASS"

Telnet Credentials

Telnet streams are readable via TCP Follow.

Wireshark quickly reveals credential leaks in insecure protocols.

Using Profiles for Faster Workflows

Profiles store:

Custom layouts
Color rules
Shortcut filters
Default columns

Profiles make repeated analysis much faster.

Why Wireshark Mastery Matters

Mastering Wireshark allows pentesters to:

Understand exact network behavior
Analyze attacks and defenses in real time
Extract sensitive data from traffic
Detect misconfigurations and leaks
Diagnose firewall and IDS responses
Trace lateral movement
Reconstruct full communication paths

Wireshark converts raw packet data into actionable intelligence.

Intel Dump

Capture from interfaces and save as PCAP
Use display filters for specific protocols
Analyze TCP, HTTP, DNS, TLS, and SMB flows
Reassemble streams and exported files
Detect scanning, MITM, and anomalies
Extract credentials from cleartext traffic
Master profiles, filters, and packet dissection