Wireshark

Wireshark is an open-source packet analyzer which is used for network troubleshooting, analysis, communications protocol development, software development, and often education.

Wireshark is regularly used to assist in the analysis of problems involving latency, dropped packets, and malicious and/or anomalous network activities. Wireshark is a very capable tool that requires a strong background and detailed knowledge about the TCP / IP stack, routing, forwarding, and DHCP functionality. 

Wireshark was invented by Gerald Combs back in 1998 – you might remember it as being initially called Ethereal. Over time, Wireshark has spread in use across a worldwide community, which continues to provide patches and strong support. In truth, Wireshark is known by the cognoscenti to really be the leading network protocol analyzer available today. 

Wireshark runs on many platforms including most Linux distributions, Windows, OpenBSD, OS X, FreeBSD, and NetBSD. Wireshark is essentially a freely licensed GPL open source. Wireshark is free to modify, re-share, and use.

Wireshark’s functionality has made it an indispensable resource for system administrators. Wireshark lets you track network traffic in real-time and helps you diagnose and resolve problems within your network. Network security engineers also use Wireshark to dig into security issues, and verify the expected operation of network applications. Developers often use Wireshark to debug protocol implementations.

At the very core of functionality, Wireshark is a powerful network protocol analyzer with a highly useful graphic user interface. Wireshark lets you interactively browse packet data within a live network. You can also capture packet data. Wireshark intercepts traffic and transforms it into human-readable format. System administrators can easily determine what is happening with the network and the overall bandwidth and latency demonstrated by the movement of data. 

Wireshark can capture not only passwords, but any kind of information passing through the network – usernames, email addresses, personal information, pictures, videos, anything. As long as we are in position to capture network traffic, Wireshark can intercept and essentially “sniff” passwords going past in the network. Wireshark is powerful—it can also be used for TLS encrypted traffic capture and analysis. In this scenario, the browsers store symmetric session keys. The system administrators can then load these session keys into Wireshark along with the correct browser setting, and then have full visibility to web traffic. 

Wireshark also has great breadth of capability, with support for two thousand+ network protocols. Of course, the basic and important support for TCP, UDP, and ICMP are what 99% of Wireshark users need day-to-day.

Wireshark also has useful capture filters features. Capture filters collect the type of traffic specified, and then another feature called display filters lets you rapidly zoom in on the traffic you need to examine. Wireshark provides search (with regular expression support) and highlighting features. 

Anomalous traffic is not always malicious, but it is always a critical place to start in the hunt for threat actor activity. Wireshark helps you capture all traffic, establish  a baseline, and then it becomes much easier to detect abnormal traffic. Wireshark’s includes highly useful tools to create and store these baseline statistics. Recognize that Wireshark is not an intrusion detection system—but once you find something anomalous and possibly threatening, Wireshark helps you identify it and analyze it quickly.

Encrypted TLS traffic may also need capture and analysis. Wireshark can also help in this area. Symmetric session keys are stored in the browser. The network administrator can load those session keys into Wireshark to view all the unencrypted traffic. 

No tools like this would be complete without graphic visualization tools. Wireshark comes with graphical tools to visualize the data, identify trends, and to then present the data to senior management or team leaders. 

Wireshark is also used for a variety of educational applications. Wireshark documentation is complete enough that a beginner can download and set up Wireshark, identify their local Wi-Fi access point, and then start scrutinizing traffic.

Wireshark can help you identify and diagnose many common network problems. Wireshark lets you closely examine your  network traffic, and then provides tools to filter and sift through that traffic, ultimately zeroing in on the root cause of the problem. Network administrators can use Wireshark to identify malfunctioning network appliances, unusual network latency issues, and attempted data exfiltration.

That said, Wireshark is not for everybody. Wireshark is a powerful tool that requires sound knowledge of networking basics. For most modern enterprises, that means understanding the TCP/IP stack, how to read and interpret packet headers, and how routing, port forwarding, and DHCP work, for example.

Wireshark can handle a wide diversity of file formats. Wireshark identifies the file formats automatically and then can also read the compressed versions that may be using GZIP. Wireshark recognizes this directly from the file contents. In fact, the ‘.gz’ extension is not required by Wireshark for this purpose.

In terms of the dashboard, Wireshark’s main window displays three view of a packet. You can see a summary line, a packet details display and then a hex dump of the packet. Wireshark can assemble all the packets in a TCP view and then display the data (ASCII or EBCDIC or hex) within that conversation view. 

Users can access captured data networks using Wireshark’s GUI. Users can use command line switches to implement programmable edit and then transform the captured files into the edit cap framework. 

The packets within the network are visually represented in the packet monitor. Color codes are available for each packet type, which are displayed along with these details:

• Destination address of the packet
• Contents of the packet shown in text
• An destination port if that is applicable

Wireshark helps you dump packets from a capture file for analysis. Many formats are supported which include Windows-based network users Catching Sniffer and Sniffer Pro, Cisco Safe Intrusion Detection Program IPLog format, Tamosoft CommView captures, and more.

Wireshark helps you to save the tests as a capture file for analysis and review later. Wireshark supports Visual Networks Visual UpTime traffic, Novell LAN analyzer, and more.

Want to learn more? Check out our FREE Bugcrowd University to sharpen your hacking skills.

Organizations the world over need your help! Join our researcher community to connect with hundreds of organization programs focused on finding their security vulnerabilities. Our vast directory includes programs for all skill levels, across many industries and from around the world.