Mastering Wireshark: A SOC Analyst’s Reference Cheatsheet

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Wireshark?

Wireshark is an open-source network protocol analyzer that allows users to capture and analyze data packets in real-time across a network. It is extensively used by cybersecurity professionals for troubleshooting network issues, analyzing security threats, and gaining insights into network protocols.

Installation

Wireshark can be installed on multiple operating systems, including Windows, macOS, and Linux. Users can download it from the official site or use package managers.

# On Ubuntu/Debian
sudo apt install wireshark

# On macOS using Homebrew
brew install wireshark

# On Windows
Download the installer from https://www.wireshark.org/download.html

Basic Syntax

To start Wireshark, simply execute the following command:

wireshark

Packet Capture and Discovery

• wireshark -i – Start capturing on a specific interface.
• wireshark -k -i – Start capturing packets and display them live.
• -f "filter expression" – Set a capture filter for only the packets you want.

Scanning and Filtering

The power of Wireshark lies in its filter capabilities:

• ip.addr==192.168.1.1 – Filter packets from/to a specific IP address.
• tcp.port==80 – Filter HTTP traffic.
• http.request – Show only HTTP requests.

Exploitation Techniques

Capture and analyze potential malicious traffic:

• -r .pcap – Read from a saved capture file for offline analysis.
• -Y "http.response" – Display only HTTP response packets.

Analysis and Protocol Dissection

Wireshark offers robust analysis tools:

• Utilize Statistics > Protocol Hierarchy to view bandwidth consumption by protocol.
• Use the Expert Info feature for notification of potential issues in traffic.

Reporting and Exporting Data

To export filtered data for reporting:

• File > Export Specified Packets... – Export filtered packets as needed.

Quick Reference Table

Pro Tips

• Utilize CTRL + F for quick filtering.
• Master the syntax of display filters to save time in analysis.
• Save commonly used filters for future use through Display Filter Toolbar.

Real-World Examples

1. **Identifying Malicious Traffic**:

wireshark -k -i eth0 -f "tcp port 443" -Y "http.request or http.response"

2. **Analyzing a DDoS Attack**:

wireshark -i eth0 -f "icmp"

These commands capture and analyze specific traffic patterns, helping you to understand the scenarios and respond appropriately.