Sniffing · Module 08
Wireshark
Capture and analyze network traffic packet by packet.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Wireshark is an open-source network protocol analyzer (packet sniffer) with a graphical interface.
Capture and inspect live network traffic in detail, down to the individual packet and protocol field.
Traffic analysis, troubleshooting, protocol inspection, and incident investigation in authorized environments.
Key features
Captures in real time or opens saved .pcap/.pcapng files.
Decodes hundreds of protocols down to individual fields.
Powerful syntax to isolate the traffic of interest.
Reconstructs full TCP/HTTP conversations for easy reading.
Graphs and summaries: protocol hierarchy, conversations, I/O graphs.
Important commands
wiresharkLaunch the Wireshark GUI.
tshark -i eth0Capture live traffic on eth0 from the command line.
tshark -r capture.pcapRead and display a saved capture file.
tshark -i eth0 -w output.pcapCapture traffic and write it to a file.
tshark -r capture.pcap -Y "http"Apply a display filter to a saved capture.
tshark -DList available capture interfaces.
Practical examples
tshark -i eth0 -w capture.pcap
Purpose Captures live traffic on eth0 and saves it for later analysis.
tshark -r capture.pcap -Y "http.request"
Purpose Displays only HTTP request packets from a saved capture.
tshark -r capture.pcap -Y "ip.addr == 192.168.1.10"
Purpose Shows only packets to or from a specific host.
Important points
- Display vs capture filters: Capture filters limit what is captured; display filters limit what is shown.
- Privileges: Live capture usually needs elevated privileges or a capture group.
- Encrypted traffic: TLS payloads can't be read without session keys, though headers stay visible.
- Large captures: Long captures produce big files — use filters and ring buffers.
- Authorization: Capturing on networks you don't own or control can violate privacy laws.
Common use cases
Diagnose latency, failures or misconfigurations.
Review captured traffic for signs of malicious activity.
Study how protocols behave in authorized labs.
Verify the traffic other tools generate during an engagement.
This tool is taught in Module 08
Read the full written notes, with diagrams, defense and detection.