📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
What is Wireshark?
Wireshark is an open-source packet analyzer essential for network troubleshooting, analysis, and penetration testing. It allows users to capture and inspect data packets across a network, providing insight into the traffic and potential vulnerabilities.
Installation
Wireshark can be installed on various operating systems. For Windows, download it from the official website. For macOS, you can use Homebrew:
brew install --cask wireshark
For Linux, use:
sudo apt-get install wireshark
Basic Syntax
The basic command format to start Wireshark is:
wireshark [options] [capturefile]
Discovery
List Available Interfaces
To see all available network interfaces, use:
wireshark -D
Capture on Specific Interface
To capture packets on a specific interface:
wireshark -i [interface]
Scanning
Capture Live Traffic
To start capturing packets immediately:
wireshark -k -i [interface]
Write Capture to File
To write capture data directly to a file:
wireshark -i [interface] -w [filename]
Exploitation
Capture and Filter by Protocol
To capture only TCP traffic:
wireshark -i [interface] -f "tcp"
Analysis
Apply Display Filters
To filter the displayed packets in real-time:
tcp.port == 80
Follow TCP Stream
To follow a particular TCP stream:
right-click -> Follow -> TCP Stream
Evasion
Capture with Promiscuous Mode
To enter promiscuous mode which allows capturing all traffic:
wireshark -i [interface] -p
Reporting
Export Packet Data
To export captured packets to a specific format:
wireshark -r [filename] -w [export_filename]
Quick Reference Table
| Flag | Description |
|---|---|
| -D | List available interfaces |
| -i [interface] | Capture data on a specified interface |
| -f [filter] | Set capture filter |
| -w [filename] | Write output to a file |
Pro Tips
- Use color rules for quick visual analysis of specific traffic types.
- Set up custom profiles for different tasks (e.g., troubleshooting, pentesting).
- Utilize the “Export Objects” feature to extract files from HTTP traffic.
Real-World Examples
Example of capturing only HTTP traffic:
wireshark -i [interface] -f "tcp port 80"
Example of saving the capture for analysis later:
wireshark -i [interface] -w http_traffic.pcap