📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
What is Wireshark?
Wireshark is a free and open-source packet analyzer that is widely used in network troubleshooting, analysis, software, and communications protocol development. It allows users to capture and interactively browse traffic on a computer network.
Installation
Wireshark can be installed on various operating systems including Windows, macOS, and Linux. To install on different platforms:
- Windows: Download the installer from wireshark.org/download, run the installer, and follow the prompts.
- macOS: Install via Homebrew:
brew install --cask wireshark - Linux: Use your package manager; for example, on Ubuntu:
sudo apt install wireshark
Basic Syntax
To capture packets, use the following command:
wireshark -i interface -k
Where interface is the name of the network interface you want to capture data from. You can find the list of interfaces by running wireshark -h.
Discovery
Wireshark can help discover network devices and protocols.
- To list available interfaces for packet capture:
wireshark -D
Scanning
Wireshark is not a scanning tool per se, but you can analyze scanning results from other tools.
- Run a network scan with Nmap and capture the traffic:
nmap -sS -p- 192.168.1.0/24
Exploitation
Use Wireshark to capture exploitation attempts and analyze payloads.
- To filter out specific attack patterns, use display filters:
tcp.dstport == 80 && http.request
Analysis
Analyzing captured traffic is essential for identifying risks:
- To analyze HTTP traffic:
http.request
- To view statistics on captured packets:
Statistics > Protocol Hierarchy
Evasion
To evade detection, use techniques to obfuscate your packets:
- Check for anomalous patterns and anomalies:
tcp.analysis.retransmission
Reporting
Export your findings for reporting purposes:
- To save captured packets:
File > Export Specified Packets
Quick Reference Table
| Flag | Description |
|---|---|
| -i | Specify the network interface |
| -D | List available interfaces |
| -k | Start capturing immediately |
Pro Tips
Color Coding: Customize packet colors by going to View > Coloring Rules to help visually distinguish between different types of traffic.
Expert Information: Use Expert > Expert Info Composite to help identify issues in your traffic.
Real-World Examples
Identifying Malware Communication: Capture packets while a malware sample runs:
wireshark -i eth0 -k
Network Troubleshooting: Capture only DNS packets:
dns