← News
/PLAYBOOK · 2026-07-29

Wireshark Packet Analysis Primer: Practical Network Traffic Security Detection

Wireshark is the core packet-capture tool in network security analysis. From install and config through hands-on analysis, this guide covers capturing and detecting DNS tunnels, SQL injection, port scans, slow attacks, and related threats, plus efficient tshark CLI usage.

Scope

For security ops, pentesters, and developers who investigate threats via packet capture. Typical uses: malware C2 patterns, unencrypted sensitive-data transfers, DNS tunneling, slow-attack source fingerprints, verifying WAF rules.

Prerequisites

Linux CLI install:

# Ubuntu/Debian
sudo apt-get install -y wireshark tshark

# CentOS/RHEL
sudo yum install -y wireshark

# Add the current user to the wireshark group (avoid sudo every time)
sudo usermod -aG wireshark $USER
# Takes effect after re-login

How it works

Wireshark is the most widely used protocol analyzer. It captures raw packets via libpcap/WinPcap. Pipeline:

Attacker activity leaves network traces. Wireshark makes those traces visible.

Steps

Step 1: Choose the capture interface

# CLI: list all available interfaces
tshark -D

# Wireshark GUI: Capture → Options after start
# Typical choices:
#   - eth0/ens33: wired NIC (server traffic)
#   - wlan0: wireless NIC
#   - any: all interfaces (Linux only)

On cloud hosts, pick the correct vNIC (eth0, ens5). If unsure, run ip addr and confirm the active interface.

Step 2: Configure a capture filter (Capture Filter)

BPF filters at capture time and cuts noise:

# Capture only TCP on ports 80 and 443
tcp port 80 or tcp port 443

# Capture only traffic to/from a specific IP
host 192.168.1.100

# Capture only DNS queries and responses
port 53

# Exclude SSH (avoid self-generated noise)
not port 22

# Combined: HTTP/HTTPS for a specific IP, exclude SSH
host 10.0.0.5 and (tcp port 80 or tcp port 443) and not port 22

Step 3: Analyze threats with display filters (Display Filter)

Display filters apply after capture. Stronger than BPF; field-level.

1. Detect unencrypted HTTP logins

http.request.method == "POST" and http contains "password"

Follow TCP Stream shows plaintext username and password.

2. Identify DNS tunneling

dns.qry.name.len > 30 and dns.flags.response == 0

DNS tunnels typically encode data in long subdomains. Query length is well above normal (typical DNS queries < 30 characters).

3. Detect port scans

tcp.flags.syn == 1 and tcp.flags.ack == 0 and tcp.flags.reset == 1

SYN-ACK-RST is a classic scan fingerprint. Many SYNs to different destination ports with no following ACK indicate SYN scanning.

4. Find oversized packets (possible data exfil)

frame.len > 1000 and tcp.port == 80

Normal HTTP requests are small. Large response bodies may be CDN assets—exclude those. Combine with data.len for outbound outliers.

5. Locate Slowloris

http.request and frame.time_delta > 10

Slowloris sends HTTP headers slowly; inter-packet delay far exceeds a normal browser. Filter HTTP requests with gap > 10 seconds.

Step 4: Rebuild sessions with Follow TCP Stream

In the Wireshark GUI:

# Select a packet of interest → right-click → Follow → TCP Stream
# Or shortcut: Ctrl+Alt+Shift+T

CLI:

# Export a specific stream first
tshark -r capture.pcap -Y "tcp.stream eq 0" -T fields -e tcp.payload

# Or inspect HTTP request+response directly
tshark -r capture.pcap -Y "http" -T fields -e http.request.full_uri -e http.response.code

TCP Stream shows the full client-server conversation: plaintext credentials, SQLi payloads, XSS, and other attack content.

Step 5: Statistics and export

# Protocol hierarchy stats
tshark -r capture.pcap -z io,phs

# HTTP request stats
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri | sort | uniq -c | sort -rn | head -20

# Endpoint stats (which IPs talk most)
tshark -r capture.pcap -z endpoints,ip

# Export a specific conversation
tshark -r capture.pcap -Y "ip.addr == 10.0.0.5" -w filtered.pcap

Step 6: Case study — SQL injection attempts

# Filter HTTP POST during capture
tshark -i eth0 -Y "http.request.method == POST" -T fields -e http.host -e http.request.uri -e http.file_data

# Find packets containing SQL keywords
tshark -r capture.pcap -Y "http contains \"SELECT\" or http contains \"UNION\" or http contains \"1=1\"" -T fields -e frame.number -e http.request.uri -e http.file_data

Verification

# Verify capture works
tshark -i eth0 -c 10  # Stop after 10 packets

# Verify the pcap is readable
tshark -r capture.pcap -q -z io,stats

# Test the BPF filter
tcpdump -i eth0 -c 5 "tcp port 80"  # Shares BPF syntax with Wireshark; confirm the filter with tcpdump first

FAQ

Q1: Capture only shows my own packets (no other traffic)?

Two cases: ① on a switched network, a non-mirror port cannot see other hosts (need SPAN/port mirroring); ② cloud vSwitches isolate by default. Fix: capture on the target host, or enable VPC traffic mirroring / security logs. On cloud VMs, install Wireshark on the target.

Q2: pcap is too large — how to split it?

# Split by file size (100MB each)
tshark -i eth0 -b filesize:102400 -b files:5 -w capture.pcap

# Split by time (one file every 30 minutes)
tshark -i eth0 -b duration:1800 -b files:10 -w capture.pcap

-b filesize is in KB (102400 = 100MB). -b files keeps at most N files (ring buffer). For continuous capture, pair with logrotate.

Q3: Wireshark shows many TCP Retransmissions. Is that an attack?

Not necessarily. Retransmits come from congestion, bad links, or overloaded servers. If they concentrate on one IP and come with ZeroWindow, the attacker may be draining connection resources (Slowloris or SYN flood). Filter with tcp.analysis.retransmission.

Takeaway

Wireshark is a foundational network-security analysis tool. Tight capture and display filters isolate attack signatures in high-volume traffic. Pair with IDS: Suricata/Snort for alerts, Wireshark for deep inspection of the matching flow. Periodic packet audits on critical servers surface covert threats.