OPERATOR REFERENCE · WIRESHARK / PACKET ANALYSIS

Wireshark Practical Field Guide
Capture · Filter · Follow · Analyze

capture → capture filter → display filter → follow stream → analyze → export — one page, every day

Scope note: filter fields and menu paths below target Wireshark 4.x. Some dissector field names shifted from an ssl.* prefix to tls.* across versions, and coloring-rule defaults/menu wording can vary by release — items marked VERIFY are worth a quick check against your installed version. Only capture traffic on networks and systems you're authorized to monitor — packet capture of traffic that isn't yours to inspect is illegal in most jurisdictions; everything here assumes lab, own-network, or authorized engagement use.

CAPTURE · BPF filter

live traffic

DISPLAY · filter bar

isolate

ANALYZE · streams / stats / export

01 Capture Basics

▶

Start / Stop

Double-click an interface on the start screen, or Capture → Options to pick one first
Ctrl+E toggles capture start/stop
Capture → Restart to clear the buffer and start fresh

👁

Promiscuous Mode

On by default in Capture Options — captures all frames the NIC sees, not just ones addressed to it. On switched networks you still only see broadcast/multicast/your-own traffic unless you're on a mirror/SPAN port or a tap.

✂

Snap Length

Capture Options → limits how many bytes of each packet are captured. Useful to shrink file size when you only need headers, but truncates payload you might want later (e.g. Export Objects).

🔁

Ring Buffer / Multiple Files

Capture Options → Output → "Create a new file automatically after…" (size/time) + "Use a ring buffer with N files" — the standard way to run a long unattended capture without filling the disk.

🔑

Permissions

Live capture needs elevated access to the NIC — on Linux, add your user to the wireshark/pcap group (avoid running the whole GUI as root); on Windows, Npcap must be installed.

📶

Remote / Headless Capture

ssh user@host "tcpdump -i eth0 -w - -U" | wireshark -k -i -

Streams a live remote capture straight into the local GUI without ever writing a file on the remote box.

02 Capture Filters (BPF syntax)

◎

What They Are

Set in Capture → Options → Capture Filter (or -f on the CLI). Applied before packets are captured — anything that doesn't match is gone, not just hidden.

🖧

Host / Net / Port

host 192.168.1.10 net 192.168.1.0/24 port 443

⇄

Direction

src host 10.0.0.5 dst port 22

∧

Combining Terms

tcp port 80 or tcp port 443 not broadcast and not multicast host 10.0.0.5 and not port 22

⚠

BPF ≠ Display Filter

⚠ capture filters use tcpdump/BPF syntax (host, port), NOT Wireshark's ip.addr== style — mixing the two syntaxes is the #1 "my filter won't apply" mistake

03 Display Filter Syntax

◎

What They Are

Typed into the filter bar after capture — non-matching packets are hidden, not discarded, so you can loosen the filter later without recapturing.

Comparison Operators

ip.addr == 192.168.1.10 tcp.port != 80 frame.len > 1400

Symbolic (==, !=) and English (eq, ne) forms both work.

∧

Combining Terms

tcp.flags.syn==1 && tcp.flags.ack==0 http || dns !(arp || icmp)

🔤

String Matching

http.host contains "example" frame matches "(?i)password"

contains is a plain substring match; matches takes a regex.

🎨

Apply-As-Filter Shortcut

Right-click any field in the packet detail pane → Apply as Filter / Prepare as Filter — fastest way to build a correct filter without memorizing field names.

✓

Autocomplete & Validation

The filter bar turns green for valid syntax, red for invalid, and yellow for a filter that's valid but probably not what you meant (e.g. comparing a field to the wrong type).

04 Display Filter Cookbook

Category	Filter	Shows
HTTP	http.request	Only HTTP request packets
HTTP	http.response.code >= 400	HTTP error responses (4xx/5xx)
HTTP	http.authorization	Basic/other auth headers — cleartext creds if not HTTPS
DNS	dns.flags.response == 0	DNS queries only
DNS	dns.flags.rcode != 0	Failed DNS lookups (NXDOMAIN, SERVFAIL, etc.)
TLS	tls.handshake.type == 1	Client Hello (SNI, offered ciphers)
TLS	tls.handshake.type == 2	Server Hello (chosen cipher/version)
TLS	tls.handshake.extensions_server_name	Packets carrying an SNI hostname
TCP health	tcp.analysis.retransmission	Retransmitted segments — packet loss upstream
TCP health	tcp.analysis.duplicate_ack	Duplicate ACKs — early sign of loss/reordering
TCP health	tcp.analysis.zero_window	Receiver's buffer is full — sender must pause
TCP health	tcp.analysis.out_of_order	Segments arriving out of sequence
TCP	tcp.flags.syn==1 && tcp.flags.ack==0	New connection attempts (SYN only)
TCP	tcp.flags.reset==1	Connection resets (RST)
Layer 2/3	arp	All ARP traffic
Layer 2/3	eth.dst == ff:ff:ff:ff:ff:ff	Broadcast frames
Layer 2/3	vlan.id == 20	Traffic tagged with VLAN 20
Layer 2/3	icmp	Ping and ICMP error messages
Conversation	ip.addr==10.0.0.5 && ip.addr==10.0.0.9	Only traffic between these two hosts
Noise reduction	!(arp or icmp or dns)	Hide chatty background protocols to see what's left
Content search	frame contains "password"	Any packet with that literal byte string anywhere
FTP	ftp.request.command=="USER" \|\| ftp.request.command=="PASS"	Cleartext FTP credentials
Quality	expert.severity == "error"	Everything Wireshark's expert analyzer flagged as an error
Size	frame.len > 1400	Large frames — useful when chasing fragmentation/MTU issues

05 Following Streams & Exporting Objects

🧵

Follow Stream

Right-click a packet → Follow → TCP Stream / UDP Stream / HTTP Stream / TLS Stream — reassembles the full conversation in order, colored by direction (client vs server).

📤

Export Objects

File → Export Objects → HTTP / SMB / DICOM / TFTP — pulls files transferred in the capture back out to disk, one click per object.

⚠ HTTPS/TLS traffic can't be object-exported unless it's been decrypted first (see Security & Forensics below)

🔍

Filter From a Stream

tcp.stream == 4

Each TCP/UDP conversation gets a stream index — filtering on it isolates just that conversation without typing IPs/ports.

06 TCP Analysis & Expert Info

🤝

Three-Way Handshake

SYN → SYN-ACK → ACK. A SYN with no SYN-ACK reply means the destination is unreachable, filtered, or not listening on that port.

📏

Window Scaling

tcp.options.wscale.shift

Needed for full throughput on long-fat-network links (high bandwidth × high latency) — missing/mismatched scaling caps effective throughput regardless of link speed.

⏱

Round-Trip Time

Statistics → TCP Stream Graphs → Round Trip Time, or the tcp.analysis.ack_rtt field on individual packets.

🩺

Expert Information

Analyze → Expert Information aggregates every retransmission, dup ACK, zero window, and checksum warning into one sortable summary — the fastest first stop when a capture "feels slow."

🧮

Checksum Warnings

⚠ "bad checksum" on packets captured on the sending host is usually a false positive from NIC checksum offload — the NIC fills it in after the OS hands the packet to Wireshark's capture point. Disable checksum validation in Preferences if it's cluttering the view.

⛔

Reset (RST) Analysis

An RST right after SYN-ACK often means an app-layer/firewall rejection rather than a routing problem — check which side sent it and how quickly.

07 Statistics Tools

▤

Protocol Hierarchy

Statistics → Protocol Hierarchy — percentage breakdown of bytes/packets by protocol stack. First stop to spot an unexpected protocol dominating the capture.

💬

Conversations

Statistics → Conversations — top talkers by IP/TCP/UDP pair with byte counts and duration; right-click a row to apply it as a filter.

🖧

Endpoints

Statistics → Endpoints — per-host totals rather than per-pair; useful for spotting one machine generating unusual volume.

📈

IO Graph

Statistics → I/O Graph — throughput over time, can overlay multiple display filters as separate colored lines (e.g. retransmissions vs total traffic).

🔀

Flow Graph

Statistics → Flow Graph — sequence-diagram view of a conversation's packets over time; great for explaining a handshake or negotiation to someone else.

🌐

DNS / HTTP Stats

Statistics → DNS and Statistics → HTTP submenus break down response times and status codes without building a manual filter first.

08 Coloring Rules

🎨

Default Rule Meaning

black-on-red — TCP resets/errors
black-on-yellow — TCP issues (retransmission, out-of-order)
light purple — TCP
light blue — UDP
light green — HTTP

VERIFY — exact default palette/rule set has changed across Wireshark versions; check View → Coloring Rules against what's actually installed.

✎

Custom Rules

View → Coloring Rules — add a filter expression + foreground/background color. Rules are evaluated top-down, first match wins, same as firewall rule ordering.

🙈

Temporary Highlight

Right-click a field → Colorize with Filter for a quick one-off highlight without permanently editing the rule set.

09 tshark (Command Line)

📋

List Interfaces

tshark -D

💾

Capture to File

tshark -i eth0 -w capture.pcapng tshark -i eth0 -f "port 443" -c 500

-f is a capture (BPF) filter, -c stops after N packets.

🔎

Read + Display Filter

tshark -r capture.pcapng -Y "http.request"

-Y is a display filter, applied after reading — same syntax as the GUI filter bar.

📊

Field Extraction

tshark -r capture.pcapng -T fields \
  -e ip.src -e ip.dst -e tcp.port \
  -E separator=,

Turns a capture into a CSV — the building block for piping packet data into a script or spreadsheet.

📐

Built-In Statistics

tshark -r capture.pcapng -z conv,ip -q

-z exposes many of the GUI's Statistics views (conv, io,phs, http,tree, etc.) from the CLI; -q suppresses the per-packet listing.

🗂

Split / Merge

editcap -c 100000 big.pcapng split.pcapng mergecap -w merged.pcapng file1.pcapng file2.pcapng

10 Security & Forensics Use

🔓

Decrypting TLS

export SSLKEYLOGFILE=~/tls-keys.log

Set that env var before launching the browser/client, then point Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename at the same file — decrypts TLS 1.2/1.3 sessions captured while that env var was active.

🕵

Port Scan Detection

tcp.flags.syn==1 && tcp.flags.ack==0

One source hitting many sequential destination ports with no completed handshake is the classic signature — check Statistics → Conversations for the fan-out pattern.

🎭

ARP Spoofing Detection

arp

Watch for the same IP resolving to two different MAC addresses, or Wireshark's own "Duplicate IP address configured" expert warning.

🔑

Cleartext Credential Hunting

http.authorization or ftp.request.command=="PASS" or telnet

Follow the stream once a candidate packet is found to see the full exchange in context.

⚖

Authorized Use Only

⚠ everything in this section assumes you own the traffic, the lab, or have explicit written authorization (pentest engagement, incident response, your own homelab). Capturing or decrypting someone else's traffic without consent is illegal in most places — this is not a "how to snoop" guide.

📝

Chain of Custody

For incident-response captures, hash the pcap immediately (sha256sum capture.pcapng) and store it read-only before analysis, so the evidence file itself isn't in question later.

11 Saving, Merging & Exporting

💾

Save Formats

pcapng (default) keeps richer metadata (comments, multiple interfaces); pcap (legacy) has the widest tool compatibility if you're feeding it into something older.

✂

Export Specified Packets

File → Export Specified Packets — save only the displayed/marked/range subset instead of the whole capture, useful for sharing a minimal repro with a colleague.

🔗

Merging Captures

mergecap -w merged.pcapng a.pcapng b.pcapng

Merges by timestamp — useful when you captured the same event from two vantage points (client + server) and want one interleaved timeline.

12 Keyboard Shortcuts

⌨

Capture

Ctrl+E — start/stop capture
Ctrl+R — reload capture file

⌨

Navigation

Ctrl+F — find packet
Ctrl+G — go to packet number
Ctrl+M — mark/unmark packet

⌨

Filtering

Ctrl+Alt+Shift+T — apply selected field as filter
Tab in filter bar — autocomplete field names

13 Common Errors & Troubleshooting

Symptom	Likely Cause / Fix
No interfaces listed	missing capture permissions — Npcap not installed (Windows) or user not in the pcap/wireshark group (Linux)
Capture filter throws a syntax error	using display-filter syntax (ip.addr==) in the capture filter field — capture filters need BPF syntax (host)
App "feels slow" but no obvious errors	check Analyze → Expert Information for retransmissions/dup ACKs first
Can't see decrypted TLS despite keylog set	keylog file must have been populated while that specific session was captured, and the Preferences path must point at it before opening the file
Dropped packets during a busy capture	increase the buffer size in Capture Options, or capture at a mirror/TAP instead of an oversubscribed host NIC
"Bad checksum" flooding the packet list	usually NIC checksum offload on the sending host — disable checksum validation in Preferences → Protocols → TCP/IP/UDP

Action	Risk
Capturing on a shared/production interface	caution can add load; prefer a mirror/SPAN port over the live host NIC where possible
Capturing traffic you're not authorized to see	unlawful get explicit authorization first — see Security & Forensics above
Exporting objects from decrypted TLS traffic	caution may contain sensitive data — handle the pcap like any other confidential artifact
Long unattended captures without a ring buffer	caution can fill disk on a busy link — always cap size/count
Display filters	safe non-destructive — they only hide packets, never discard them from the file
tshark -z / -T fields extraction	safe read-only analysis of an already-saved capture