Sweshi's Tutorials

Wireshark Tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
wireshark introduction

Wireshark is a popular open-source network protocol analyzer used for network troubleshooting, analysis, software and communications protocol development, and education. It allows users to capture and examine the data traveling back and forth on a computer network in real-time. Originally known as Ethereal, Wireshark is available for various operating systems, including Windows, macOS, and Linux.

It is available as a wireshark portable or installer. On Kali, Linux, it should be already installed but you can download wireshark on this link Download Wireshark. Get the installer and install it normally just like any other program or download wireshark portable and just run it on your OS. If you want to capture packets through a USB port, make sure to install the USBPcap as well.

How to use wireshark
Capture Traffic Using Wireshark GUI

Start wireshark from your menu in your OS. There are a number of interfaces that we can listen on. I will be using the wireless interface to capture data. So I clicked on it and then clicked on the "capture" button to start capturing traffic. You should be able to see at least some of the following;

  • Wi-Fi - For wireless interfaces
  • loopback adapter - for localhost traffic
  • Local Area Connection X - For ethernet connections.
  • bridge - for a network bridge
  • bluetooth
  • and many more, some of which could be virtual.

For this tutorial, am capturing traffic coming through my wireless interface so I selected the Wi-Fi option since that is where I am connected.


Capture and filter packets with wireshark:

Something that most people are using is the delta time column. We shall add the coloumn to our window by clicking on Edit->Preferences->Columns. Once on columns, click the "+" button and name it to "Delta". You should also change the type to "Delta Time Displayed". Drag the new "Delta" column just underneath the Time column. This will enable us to view the difference in time between packets which might be useful in forensic investigations.

Capture and filter packets with wireshark:

For forensic analysis, we might also want to know the specific time that the packets were captured not just the difference between packets, so we will also change the time column to be using a UTC format. This will help us know exactly when packets were captured which can correlate with perhaps when an intrusion occured.

To stop capturing, you can click on the RED button on the top left that says stop capturing.

Adding command line tools of wireshark in a Windows OS

We will also show how to capture with the command line and using dumpcap. If you are on windows, you might have to add the command line tools to the environment variables. Since I installed the x64 version, I can find the command line tools in "C:\Program Files\Wireshark" but a 32bit installation should be in"C:\Program Files (x86)\Wireshark". Click on your start menu and search for "environment variables". Click on the result and then go to "environment variables"

Click on Path->New->Browse. Navigate to the installation directory of your wireshark depending on whether it is 32bit or 64bit. You can click OK on all the windows to save the entry. You might have to restart for changes to take effect. Kali Linux machines should already be able to use the command line utilities.

Capture and filter packets with wireshark: adding environment variables to wireshark in windows operating system.

After restarting your system go to the command line and type the following command

dumpcap -D

This will list the interfaces that are available on your machine.

Capture and filter packets with wireshark:listing interfaces using dumpcap on the command line.

To select an interface, pick the interface number. For example, my Wi-Fi interface is on number 4 so I can select it like this;

dumpcap -i 4

This should start capturing and should be able to show you that it is recieving packets. For now, we will close this by using Control+C.

Capture and filter packets with wireshark: capturing on wifi interface using dumpcap.

We can also choose where to save the captured traffic on our machine. In this case I will choose my Documents folder for this user account.

dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng

You can replace the directory with your own. If you navigate to your directory, you will be able to see the capture packet. Control + C to stop the capture.

Capture and filter packets with wireshark:saving our dumcap wifi capture to a chosen location.

We can use ring buffers to limit the file sizes for each packet we capture. This can limit how much traffic is captured per packet which is useful if the system is capturing traffic for a very long time. \ For this example, we will limit the sizes to only 80kilobyte sizes using the "filesize:80".

dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng -b filesize:80

This is an extremely small size so it will be splitting the pcap files by 80 KBs. You will see that there will be a PCAP files of 80KB in the directory you are saving the capture. In practice, you are more likely to make a size that is much larger such as 250MB or even much more.

Capture and filter packets with wireshark: limiting the dumpcap capture size to 80 kilobytes.

We can also limit how many PCAP files it should generate such that if we say 5 PCAP files as the total and we exhaust the 5 files, it can begin to overwrite the PCAPs you captured in the first instance. The "files:5" options will make sure that our directory only has 5 PCAP files at the most.

dumpcap -i 4 -w /users/sweshi/Documents/wifi.pcapng -b filesize:80 files:5 Capture and filter packets with wireshark: limiting the number of files to generate using dumpcap.
How to filter packets using Wireshark
Capture Filters in Wireshark

We can filter based on display or capture. Capture filters limit what type of packets we recieve such as limiting Wireshark to only capture IPv6 traffic or DNS traffic. Display filters work on captured traffic. They can be used to limit what we want to see from all of the captured traffic. It is not recommended to be very specific with capture filters simply because you can miss some things when trying to displaying them.

We can limit Wireshark to only capture certain packets using the fllowing syntax on the opening window. For most of these filters, you will get suggestions on how to complete them.

  • TCP
  • Capture and filter packets with wireshark:capture filter for tcp traffic in wireshark.
  • TCP specific ports such as port 53 for DNS. Just specify the port number for the service
  • Capture and filter packets with wireshark: capturing for a specific port such as DNS.
  • Capturing either TCP or UDP traffic
  • tcp Capture and filter packets with wireshark: capturing TCP or UDP traffic only in wireshark.
  • Capturing traffic for one host in IPv4
  • Capture and filter packets with wireshark:capturing traffic from a specific host IPv4.
  • Capturing traffic for one host in IPv6
  • Capture and filter packets with wireshark: capturing traffic from a specific host on wireshark IPv6.
  • Capturing packets and specifying multiple ports
  • Capture and filter packets with wireshark: capturing packets for multiple ports.
  • How to capture everything but leave out some packets. In this case we leave out HTTP and SMTP
  • Capture and filter packets with wireshark:capturing other packets but not port 80 or port 25.
  • Capturing packets that have a specific mac address
  • Capture and filter packets with wireshark: capturing traffic that has a specific ethernet address.
    Display filter

    Delete any capture filters on the opening window and start capturing on your selected interface. There are a number of display filters that can allow us to view certain things more clearly and remove any other distractions. If you have started capturing, try the following filters. In the window that is showing you the captured packets, insert the filters in the area highlighted with the red arrow. you can press enter when you insert a filter and you can press the "X" button at the end of the filter bar to clear the filter.

    Capture and filter packets with wireshark:where to insert display filter in wireshark.png
  • Type "ip." and see the options that IP allows you to filter with. There are many options that we can use.
  • Capture and filter packets with wireshark:ip options.
  • Filtering for packets with a specific IP address. In this case, we will look for packets that have 192.168.43.141 as the source or destination.
  • Capture and filter packets with wireshark:filtering for packets that have a source or destination of 192.168.43.141.
  • If you want packets coming from a specific source you can use the ip.src and if you want packets coming from a specific destination, you can use ip.dst.
  • Capture and filter packets with wireshark: filtering for packets coming from a specific source.
  • You can filter for a specific port and protocol using the tcp.port or the udp.port.
  • Capture and filter packets with wireshark:filtering for port 80.
  • Filtering for ARP traffic
  • Capture and filter packets with wireshark:arp.png
  • Filtering for DNS traffic
  • Capture and filter packets with wireshark:dns.png
  • Filtering for HTTP requests. Notice the links because this is unencrypted traffic.
  • Capture and filter packets with wireshark:http requests.
  • Filtering for Cookies, UIDs and Passwords
  • Capture and filter packets with wireshark: searching for cookies, uids and passwords.
    A bit of Name Resolution in wireshark

    Name resolution can help us with how we view the information from the captured packets. The first thing we will do is enable transport protocol name resolution. This will enable most of the well known ports to be labelled with their service names. Go to edit->preferences->Name Resolution.

    Capture and filter packets with wireshark:tranport protocol name resolution.

    You might want to also resolve the IP addresses to the domain names for the IP addresses in the captured file. In that case check the next option as shown in the figure.

    Capture and filter packets with wireshark: resolve ip addresses in wireshark.

    Examples of resolved IP addresses on the source and destination as well as resolved network services such as HTTP for port 80.

    Capture and filter packets with wireshark: example of resolved IP addresses.

    Click on one packet, prefereably on one with an application layer protocol such as HTTP traffice. The bottom section of the shows the content starting from the link layer up the network layer, the transport layer and even application layer protocols such as HTTP, DHCP and more. From this view you can open one lets say IPv4 and see the contents of the IP packet. You are also able to view the hex values on the right side which could come in handy for steganalysis. If traffic is not encrypted, this is where you would see content that the user or server sent.

    Capture and filter packets with wireshark: Looking at a single packet.
    Viewing unencrypted data with wireshark

    if the traffic is sent using unencrypted channels, this can be very dangerous as someone sniffing traffic could see the content of the packets. To demonstrate this, go to any website that uses http rather than https. It is difficult to come across these today so I am testing using my webserver in my network. The concept can be used on any protocol that does not have encryption such as FTP, Telnet, SMTP and many more. Here I test using HTTP.

    I started captruing on my interface and then went to my local web server and accessed a web page. This local web server does not have HTTPS configured so it is plain HTTP used and that is the vulnerability we shall use. I went to the login page as shown in the figure. I typed some email address and password combination.

    Capture and filter packets with wireshark: example of viewing unencrypted data.

    I then went to wireshark and filted based on the password being the name of the item in the packed. So I used the following filter

    frame contains "password"

    I chose password because I know the HTML document probably named the password field with password and the email field with email. So the Get variable is likely to be named as such. Instead of searching for a get variable, you can also search for actual text that could be in the packet. From my results, I was able to see the login.php form and I clicked on it and went below to view the contents.

    Capture and filter packets with wireshark: frame contains password.

    I went to the bottom of the packet just under Hypertext Transfer Protocol and opened the HTML Form URL Encoded and saw the form items as shown in the figure below. Other protocols might have different names for the actual protocol content but it will most likely be at the bottom of every other protocol. Try finding data in other protocols that use plain text.

    Capture and filter packets with wireshark:viewing the password.
    Using statistics in wireshark

    Statistics can help to show activity on the network that could be considered unusual. It could help know if there are some vulnerabilities or if there is even an attack or leakage of data. I encourage you to view a lot of statitics in your network analysis. Here, I will show a few of my favourites.

    Protocol hierarchy : How wireshark can help us spot unencrypted traffic

    Click on Statistics->Protocol Hierarchy.

    This can be used to see what protocols have been used and to what degree. Importantly for network security, we can see if there is any "data" as shown at the bottom of the figure above. Data in this sense means the actual content of packets.We can be interested in investigating this because it can leak information. If traffic is encrypted, you wont be able to see the actual content in the "Data" but for unencrypted protocols, you will.

    Capture and filter packets with wireshark: protocol hierarchy.
    Conversations : How wireshark can help us with network forensics

    Click on Statistics->Conversations

    This can help us spot the nature of communcation between different hosts using IP address, port numbers and mac addresses. For example, we can see that we are under a DOS attack from a single machine by checking the IP addresses communicating, looking at the machines sending a lot of traffic to our IP address in a short space of time. We can combine the Address sections, the packets sections and the duration. If we are analysing this after the attack, this would clearly show who was attacking us. Multiple IP addresses could be involved in the case of a DDOS attack.

    Capture and filter packets with wireshark: conversations.

    We can also use the TCP or UDP tabs to see if there is a port scan by check which IP addresses are sending traffic on many ports. We can tell if they are trying to do host discovery by seeing IP addresses that attempt to communicate with every machine in our network.

    Capture and filter packets with wireshark:ports.
    IO Graph : Visualising data

    Click on Statistics->IO Graph

    The IO Graph can visualise our data. You can click on the + button to add a new graph to the existing ones. You can use the same display filters to get specific traffic. In this case I inserted "http" and put a "50 SMA" to smooth the data for HTTP and for all packets. This can help me compare the amount of HTTP traffic in relation to everything else.

    Capture and filter packets with wireshark: IO graph.
    Extracting Files from captured network traffic in Wireshark

    Network Security professionals are also likely to capture data and in the case of unencrypted traffic, might want to extract the file from the data or in the case of encrypted traffic, might want to captured the ciphertext. Wireshark supports saving some standard file types. You can first start by filtering the data as close to the actual data as possible. In this case I am using http to get HTTP data so that I see if I can get HTML files to rebuild. Click on File->Export Objects->HTTP. The export objects section has a few options and I choose HTTP because of the nature of my data.

    Capture and filter packets with wireshark: exporting files.

    From the window that opens, I search for PNG in hopes of finding a picture. Because I am searching from an unencrypted capture, this is easy to find. I click on one picture and go to save as. I then save the picture to my preferred directory. You could try searching for txt, html, pdf and anything that you think could have been captured.

    Capture and filter packets with wireshark: save the file.

    In the case that we dont actually know what we are looking at, we can also follow TCP streams. Look for protocol communication that can indicate file transfers. In my case with an http display filter, I know that GET and POST requests have some data so I right click and say "Follow TCP Stream".

    Capture and filter packets with wireshark: saving none standard files.

    The HTML page is shown. This is shown in ASCII but if you dont know what you are looking for, you can convert to a hex dump and see if you can recognise the file. You can use the starting hex values to determine the file type such as the following;

    Recognising wireshark hex dump using Hex values
    File Type Hex Code
    JPEG (Joint Photographic Experts Group) FF D8 FF
    PNG (Portable Network Graphics) 89 50 4E 47 0D 0A 1A 0A
    GIF (Graphics Interchange Format) 47 49 46 38
    PDF (Portable Document Format) 25 50 44 46
    ZIP (Compressed Archive) 50 4B 03 04
    MP3 (MPEG Audio Layer III) FF FB
    MP4 (MPEG-4 Part 14) 66 74 79 70
    EXE (Executable File) 4D 5A
    DOCX (Microsoft Word Document) 50 4B 03 04
    XLSX (Microsoft Excel Spreadsheet) 50 4B 03 04
    AVI (Audio Video Interleave) 52 49 46 46
    WAV (Waveform Audio File Format) 52 49 46 46
    MPG (MPEG Video) 00 00 01 B3
    TXT (Plain Text) No specific hex code (varies based on encoding)

    You can simply search for the hex value you get and see the file type. Then you can save the file using the appropriate extension.

    Capture and filter packets with wireshark:html page.

    Just by looking at the ASCII values I could see the HTML code and so I saw the HTML page and saved it as such.