 |
| Ethical Hacking |
🛡️ Ethical Hacking — Day 8
Wireshark Fundamentals: Packet Capture & Network Analysis
⚠️ LEARNING PURPOSE ONLY: This tutorial is strictly for educational and defensive cybersecurity learning. Capture and analyze traffic only on systems, networks, applications, or labs that you own or have explicit permission to monitor. Do not capture other people's traffic or attempt to intercept communications without authorization.
Welcome to Day 8.
On Day 6 and Day 7, we learned Nmap for network discovery and port/service identification.
Today we move from:
“What services are available?”
to:
“What is actually happening in the network traffic?”
Our tool for this is:
🦈 Wireshark
Wireshark is a graphical network protocol analyzer that lets you capture and interactively inspect packets from live interfaces or previously saved capture files. It provides packet summaries, detailed protocol fields, and raw/hex views. (Wireshark)
🎯 Day 8 Learning Objectives
By the end of today, you should understand:
What packets are
What frames are
How packet capture works
Network interfaces
Ethernet/Wi-Fi traffic
IP packets
TCP packets
UDP packets
DNS traffic
ICMP traffic
HTTP/HTTPS concepts
Capture filters
Display filters
Packet details
Following conversations
Saving
.pcapngcapturesWireshark on Linux, Windows, and macOS
1. What Is a Packet?
When data travels across a network, it is divided into smaller units.
A simplified representation:
Application Data
↓
TCP
↓
IP
↓
Ethernet / Wi-Fi
↓
Network
A packet may contain information such as:
Source IP
Destination IP
Protocol
Ports
Flags
Payload
2. Packet vs Frame
These terms are related but aren't identical.
A simplified model:
Ethernet Frame
┌───────────────────────────────┐
│ Ethernet Header │
│ │
│ IP Packet │
│ ┌───────────────────────┐ │
│ │ IP Header │ │
│ │ │ │
│ │ TCP/UDP │ │
│ │ ↓ │ │
│ │ Application Data │ │
│ └───────────────────────┘ │
└───────────────────────────────┘
For now, remember:
A frame is a link-layer unit; an IP packet is a network-layer unit carried inside it.
3. Why Wireshark Is Important
Imagine Nmap tells you:
443/tcp open
That's useful.
But Wireshark can help you investigate traffic such as:
Client
│
│ TCP SYN
▼
Server
│
│ SYN-ACK
▼
Client
│
│ ACK
▼
TLS communication
You can inspect the actual packets involved.
This is extremely useful for:
Network troubleshooting
Security analysis
Protocol learning
Incident investigation
Application debugging
Understanding attacks and defenses
4. Installing Wireshark
Use the official Wireshark download page rather than random third-party download sites. Wireshark provides official installers/packages for Windows, macOS, and many Linux distributions. (Wireshark)
🐧 Linux Installation
First check whether it is installed:
wireshark --version
On Debian/Ubuntu/Kali:
sudo apt update
sudo apt install wireshark
Then:
wireshark --version
Some Linux distributions may use different package managers.
🪟 Windows Installation
Check:
wireshark --version
If it isn't installed, download the official Windows installer.
The official Windows installer includes Npcap, which is required for packet capture on Windows. (Wireshark)
After installation:
wireshark --version
🍎 macOS Installation
Check:
wireshark --version
If you use Homebrew:
brew install --cask wireshark
Then:
wireshark --version
Wireshark also provides an official macOS installer; the official macOS packages are signed and notarized. (Wireshark)
5. Finding Your Network Interface
Before capturing packets, you need to know which network interface carries your traffic.
🐧 Linux
Run:
ip addr
You may see:
lo
eth0
wlan0
Modern Linux systems may use names such as:
enp0s3
ens33
wlp2s0
The exact name depends on your computer.
🪟 Windows
Run:
Get-NetAdapter
You may see:
Name
----
Ethernet
Wi-Fi
You can also use:
ipconfig
🍎 macOS
Run:
ifconfig
Common interfaces include:
lo0
en0
en1
On many Macs, en0 is the active Wi-Fi interface, but don't assume this—verify your own system.
6. Open Wireshark
Start Wireshark.
You should see available capture interfaces.
For example:
┌─────────────────────────────┐
│ Interface │
├─────────────────────────────┤
│ Wi-Fi │
│ Ethernet │
│ Loopback │
└─────────────────────────────┘
You may see different names depending on your operating system.
Look for an interface showing network activity.
🧪 Day 8 Practical Lab #1
Capture Your Own Traffic
⚠️ LEARNING PURPOSE ONLY: Capture traffic from your own computer or authorized lab only.
Select your active interface and start capturing.
Then generate some harmless traffic.
For example, open a website you are authorized to access, or use DNS locally.
After a few seconds, stop the capture.
You may see hundreds or thousands of packets.
Don't panic.
That's normal.
7. The Three Main Wireshark Panels
A typical Wireshark window contains three important areas.
┌──────────────────────────────────────┐
│ Packet List │
├──────────────────────────────────────┤
│ Packet Details │
├──────────────────────────────────────┤
│ Packet Bytes / Hex │
└──────────────────────────────────────┘
8. Packet List
The top section gives a summary.
You may see columns such as:
No.
Time
Source
Destination
Protocol
Length
Info
Example:
1 0.000 192.168.1.20 192.168.1.1 DNS
2 0.015 192.168.1.20 93.x.x.x TCP
3 0.025 93.x.x.x 192.168.1.20 TCP
9. Packet Details
Click a packet.
The middle section lets you expand protocol layers.
You might see:
Frame
Ethernet II
Internet Protocol Version 4
Transmission Control Protocol
Expand each section.
This is where you'll begin seeing the concepts from Days 2–7 in actual network traffic.
10. Packet Bytes
The bottom section displays the raw packet bytes in hexadecimal and related representations.
For now, don't worry about memorizing hexadecimal.
Just understand:
Wireshark can show both interpreted protocol fields and the underlying packet bytes.
🧪 Day 8 Practical Lab #2
Find Your Own DNS Traffic
Start a capture.
Then perform a DNS lookup.
Linux
nslookup example.com
or:
dig example.com
macOS
nslookup example.com
or:
dig example.com
Windows
nslookup example.com
Stop the capture.
Now look for DNS packets.
11. Display Filters
One of Wireshark's most useful features is its display-filter language.
Wireshark officially distinguishes capture filters from display filters. Display filters let you hide packets you aren't currently interested in while leaving the captured data intact. (Wireshark)
Try:
dns
This tells Wireshark:
Show DNS packets.
12. Important Filter Examples
DNS
dns
TCP
tcp
UDP
udp
ICMP
icmp
HTTP
http
TLS
tls
These are display filters.
13. Filter by IP Address
You can filter packets involving a particular IP.
For example:
ip.addr == 192.168.1.20
Replace the example address with an address from your own authorized capture.
You can also use:
ip.src == 192.168.1.20
to show packets originating from that address.
And:
ip.dst == 192.168.1.20
to show packets destined for that address.
14. Filter by TCP Port
For example:
tcp.port == 443
This displays TCP traffic involving port 443.
You can also use:
tcp.port == 80
for HTTP-related TCP traffic.
15. Capture Filters vs Display Filters
This is very important.
Capture filter
Controls what is captured.
Example:
tcp port 443
Display filter
Controls what is displayed after capture.
Example:
tcp.port == 443
They use different syntax. Wireshark's documentation explicitly notes that capture filters and display filters are separate filtering languages. (Wireshark Wiki)
Remember:
Capture Filter
↓
What gets captured
Display Filter
↓
What gets displayed
16. Why Use Capture Filters?
Suppose you're capturing on a busy network.
Without a filter:
100,000 packets
With a capture filter:
Only relevant traffic
This can reduce the amount of data captured.
Wireshark's documentation notes that capture filters can reduce the amount of data captured and are more efficient for filtering during capture than display filters. (Wireshark)
17. TCP Three-Way Handshake in Wireshark
This is one of today's most important exercises.
You already learned:
SYN
↓
SYN-ACK
↓
ACK
Now let's see it in actual packets.
Start a capture.
Generate TCP traffic from your own computer.
Then apply:
tcp
Look for packets containing:
[SYN]
[SYN, ACK]
[ACK]
18. Understanding TCP Flags
Common TCP flags include:
| Flag | Meaning |
|---|---|
| SYN | Start/synchronize connection |
| ACK | Acknowledge |
| FIN | Gracefully finish connection |
| RST | Reset connection |
| PSH | Push data to application |
| URG | Urgent pointer significant |
For today, focus on:
SYN
SYN + ACK
ACK
🧪 Day 8 Practical Lab #3
Observe a TCP Handshake
Start capturing on your active interface.
Then generate a new TCP connection to a service you are authorized to access.
You can use your own local service if available.
For example, if your machine has a local web service listening on port 8080:
127.0.0.1:8080
Open it in a browser.
Then filter:
tcp.port == 8080
Look for the connection establishment.
If you don't have a local service on port 8080, don't worry. You can use the traffic generated by another legitimate connection in your own capture.
19. DNS Analysis
DNS traffic can be very educational.
Apply:
dns
Look at:
Queries
Responses
Domain names
Record types
Addresses
You may encounter:
A
AAAA
CNAME
MX
TXT
We introduced these on Day 5.
Now you can see them in actual packets.
20. ICMP Analysis
We learned about ping.
Let's capture it.
Start Wireshark.
Then:
Linux/macOS
ping -c 4 127.0.0.1
Windows
ping 127.0.0.1 -n 4
Then use the Wireshark filter:
icmp
On some environments, localhost traffic may be handled through a loopback interface differently from ordinary Ethernet/Wi-Fi capture, so select the appropriate loopback interface if available.
21. What Does ICMP Look Like?
You should see concepts such as:
Echo Request
Echo Reply
Conceptually:
Your Computer
│
│ ICMP Echo Request
▼
127.0.0.1
│
│ ICMP Echo Reply
▼
Your Computer
22. HTTP vs HTTPS
If you capture normal HTTP traffic, you may be able to inspect application-layer information.
HTTPS is different.
Conceptually:
HTTP
Browser
↓
Readable HTTP data
↓
Server
while:
HTTPS
Browser
↓
TLS encryption
↓
Encrypted application traffic
↓
Server
This is why HTTPS is so important for protecting data in transit.
⚠️ Important Privacy Lesson
Never capture traffic just because you technically can.
Network captures can contain:
IP addresses
Hostnames
URLs
Cookies
Authentication information
Application data
Personal information
Even encrypted traffic can reveal metadata.
Therefore:
Treat packet captures as potentially sensitive data.
23. Follow a TCP Stream
Wireshark can reconstruct a TCP conversation from captured packets.
Right-click an appropriate TCP packet and select:
Follow → TCP Stream
This can help you understand how packets belong to the same conversation.
Wireshark's protocol-analysis features can reassemble TCP conversations for inspection. (Wireshark)
Only do this with traffic you are authorized to analyze.
24. Saving a Capture
Wireshark commonly saves captures as:
.pcapng
The native capture formats include pcapng and pcap. (Wireshark)
For example:
day8-network-analysis.pcapng
Keep these files private if they contain sensitive information.
25. TShark — Command-Line Wireshark
Wireshark also provides a command-line analyzer called TShark.
Check whether it is installed:
Linux/macOS
tshark --version
Windows PowerShell
tshark --version
TShark uses the same display-filter syntax as Wireshark. (Wireshark)
For example:
tshark -r day8-network-analysis.pcapng -Y "dns"
This reads a saved capture and displays DNS packets.
🐧 Linux Practical — TShark
Check interfaces:
tshark -D
Read a saved capture:
tshark -r day8-network-analysis.pcapng
Display only DNS packets:
tshark -r day8-network-analysis.pcapng -Y "dns"
🪟 Windows Practical — TShark
PowerShell:
tshark -D
Read a capture:
tshark -r day8-network-analysis.pcapng
Filter DNS:
tshark -r day8-network-analysis.pcapng -Y "dns"
🍎 macOS Practical — TShark
tshark -D
Read a capture:
tshark -r day8-network-analysis.pcapng
Filter DNS:
tshark -r day8-network-analysis.pcapng -Y "dns"
🧪 Day 8 Main Practical Lab
We're now going to combine everything.
Step 1 — Start Wireshark
Choose your active network interface.
Step 2 — Start Capture
Start capturing your own traffic.
Step 3 — Generate DNS Traffic
Linux/macOS
dig example.com
Windows
nslookup example.com
Step 4 — Stop Capture
Save it as:
day8-dns-analysis.pcapng
Step 5 — Apply DNS Filter
dns
Step 6 — Inspect a DNS Query
Look at:
Source
Destination
Query
Response
Record Type
Step 7 — Generate ICMP Traffic
Linux/macOS
ping -c 4 127.0.0.1
Windows
ping 127.0.0.1 -n 4
Step 8 — Filter ICMP
icmp
Step 9 — Inspect TCP
Apply:
tcp
Find a TCP connection from your own traffic.
Look for:
SYN
SYN, ACK
ACK
📊 Day 8 Analysis Table
Complete this table from your own capture:
| Protocol | Source | Destination | What did you observe? |
|---|---|---|---|
| DNS | ______ | ______ | ______ |
| ICMP | ______ | ______ | ______ |
| TCP | ______ | ______ | ______ |
| UDP | ______ | ______ | ______ |
Don't publish the actual addresses if the capture contains information about your private network or other users.
🔎 Useful Display Filters
Keep these for your notes:
dns
tcp
udp
icmp
http
tls
tcp.port == 443
udp.port == 53
ip.addr == YOUR_IP
ip.src == YOUR_IP
ip.dst == YOUR_IP
Wireshark's display-filter system is extensive; the official filter reference contains a very large set of protocol fields and expressions. (Wireshark)
Wireshark Display Filter Reference
🧠 Day 8 Security Mindset
When looking at a packet, ask:
1. Who sent it?
Source
2. Who received it?
Destination
3. What protocol is being used?
DNS?
TCP?
UDP?
ICMP?
TLS?
4. What port is involved?
Source Port
Destination Port
5. What happened?
Request?
Response?
Handshake?
Error?
6. Is the traffic expected?
This is perhaps the most important security question.
🛡️ From Nmap to Wireshark
You've now learned two different perspectives.
Nmap
"What services are available?"
Wireshark
"What traffic is actually happening?"
Together:
Network Security
│
┌─────────┴─────────┐
│ │
Nmap Wireshark
│ │
Discovery Analysis
│ │
Ports/Services Packets
│ │
└─────────┬─────────┘
↓
Security Understanding
📝 Day 8 Assignment
Answer these questions:
1.
What is Wireshark?
2.
What is the difference between a packet and a frame?
3.
What are the three main sections of the Wireshark interface?
4.
What is a capture filter?
5.
What is a display filter?
6.
What is the difference between:
tcp port 443
and:
tcp.port == 443
7.
What does the dns display filter do?
8.
What are SYN, SYN-ACK, and ACK?
9.
What is the difference between HTTP and HTTPS from a traffic-analysis perspective?
10.
Why should packet captures be treated as sensitive information?
🏆 Day 8 Challenge
Perform this workflow on your own computer:
Start Wireshark
↓
Choose your active interface
↓
Start capture
↓
Generate DNS traffic
↓
Generate ICMP traffic
↓
Generate normal TCP traffic
↓
Stop capture
↓
Save .pcapng
↓
Filter DNS
↓
Filter ICMP
↓
Filter TCP
↓
Find a TCP handshake
↓
Write your observations
Then answer:
What was the most interesting packet you found, and what did it tell you about your computer's network communication?
⚠️ Ethical Hacking Reminder
LEARNING PURPOSE ONLY: Wireshark can capture extremely sensitive information. Use it only on your own systems, your own lab, or networks for which you have explicit authorization. Never capture credentials, private communications, or other people's traffic without permission.
Capture responsibly. Analyze ethically. Protect privacy.
✅ Day 8 Summary
Today you learned:
What Wireshark is
Packets vs frames
Network interfaces
Live packet capture
Packet details
Packet bytes
DNS analysis
ICMP analysis
TCP analysis
TCP three-way handshake
HTTP/HTTPS concepts
Capture filters
Display filters
TCP stream analysis
Saving
.pcapngfilesTShark
Wireshark on Linux
Wireshark on Windows
Wireshark on macOS
Most important lesson:
Don't just look at packets—learn to explain what they mean.
A packet capture is evidence. Your job as a security professional is to interpret that evidence carefully and responsibly.
🔜 Day 9 — Wireshark Deep Dive
Tomorrow we'll go deeper into packet analysis:
Ethernet frames
MAC addresses
ARP packets
IPv4 headers
TCP flags
TCP sequence and acknowledgment numbers
UDP packets
DNS request/response analysis
Useful Wireshark filters
Following conversations
Packet statistics
Practical analysis on Linux, Windows & macOS
🔐 LEARN → CAPTURE → ANALYZE → UNDERSTAND → SECURE.
No comments:
Post a Comment