Author: Trix Cyrus

What is Packet Sniffing?
Packet sniffing is the process of capturing and inspecting data packets as they travel across a network. These packets contain valuable information like IP addresses, protocols, and data payloads. Packet sniffers like Wireshark are used for:

• Diagnosing network issues
• Identifying security vulnerabilities
• Monitoring traffic for suspicious activity
• Analyzing network performance

Getting Started with Wireshark

follow these steps to capture your first packets:

1. Launch Wireshark

Open Wireshark, and you'll see the home screen displaying a list of network interfaces (your network adapters).

2. Select a Network Interface

Choose the network interface you want to capture packets on. This could be your Ethernet or Wi-Fi adapter. Click the interface to start capturing packets.

3. Start Capturing
After selecting an interface, Wireshark will begin capturing network traffic in real time. You'll see packets being logged with information such as the source IP, destination IP, protocol, and more.

4. Stop Capturing

Once you have captured enough packets, click the red Stop button on the toolbar.

Understanding Wireshark’s Interface

• Packet List Pane: Displays all captured packets with time, source, destination, protocol, and more.

• Packet Details Pane: Shows detailed breakdown of the selected packet.

• Packet Bytes Pane: Displays the raw data of the packet in hexadecimal and ASCII format.

Basic Packet Analysis

• Viewing Packet Details: Click on any packet in the list to view its detailed structure in the Packet Details pane. You'll see different layers such as Ethernet, IP, and TCP/UDP.

• Filtering Packets: Use the filter bar to narrow down the traffic you’re interested in. For example:

• http to show only HTTP traffic.
  ip.addr == 192.168.1.1 to filter packets from/to a specific IP.
  tcp.port == 80 to show traffic on port 80 (HTTP).

Analyzing Protocols: Wireshark supports many protocols, and you can easily inspect traffic by selecting the protocol from the Packet List Pane.

For example:

• Inspect DNS requests by filtering with dns.

• Examine TCP handshakes by filtering with tcp.flags.syn == 1.

Common Use Cases for Packet Sniffing

• Diagnosing Network Latency: Look for packets with high latency and review the round-trip time.

• Troubleshooting Connection Issues: Check for retransmissions, packet drops, or errors.

• Identifying Unusual Traffic: Filter for specific IP addresses, ports, or protocols to detect malicious or abnormal traffic.

• Monitoring Bandwidth Usage: Analyze how much data is being transmitted by a particular device or protocol.

Saving and Exporting Captures

• Saving a Capture: Click File > Save As to store the captured data for later analysis.

• Exporting Specific Packets: You can also export filtered packets for further investigation by clicking File > Export Specified Packets.

Tips for Efficient Packet Sniffing

• Use Filters: Apply filters to focus on the traffic that matters. For example, you can filter HTTP traffic with http, or focus on a specific IP with ip.addr == x.x.x.x.

• Follow TCP Stream: To see the full conversation between two devices, right-click on a TCP packet and select Follow > TCP Stream. This will display the complete exchange in a readable format.

• Capture Only What You Need: Capturing too much traffic can be overwhelming and hard to manage. If you're looking for specific traffic (e.g., DNS requests), filter your capture by the desired protocol or IP range.

Wireshark Best Practices

• Capture on the Right Interface: Ensure you're capturing traffic on the correct network interface (Wi-Fi, Ethernet, etc.).

• Keep Capture Time Short: Longer captures can result in large files and unnecessary data. Focus on specific time frames when problems occur.

• Use Display Filters: This helps narrow down the view to specific packets of interest, reducing the complexity of the analysis.

-Save Captures for Documentation: Always save interesting captures for further analysis and documentation.

~TrixSec