📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
What is Wireshark?
Wireshark is a widely-used network protocol analyzer that provides deep insights into network traffic, making it invaluable for SOC analysts and penetration testers.
Installation
Wireshark can be installed on various platforms, including Windows, macOS, and Linux. Download the installer from the official Wireshark website and follow the installation instructions.
Basic Syntax
The basic syntax to start capturing packets is:
wireshark -i-k
Replace
Discovery
Identify Interfaces
To list available network interfaces, use:
wireshark -D
Capture Filters
Use capture filters to limit the packets that Wireshark captures:
wireshark -i
Scanning
Examine Live Traffic
To start capturing traffic in real-time:
wireshark -i
Exploitation
Analyze Specific Protocols
Set display filters to analyze specific protocols:
tcp || http
Analysis
Follow TCP Stream
To view the entire conversation of a TCP connection:
Right-click on packet > Follow > TCP Stream
Evasion
Hide Packet Analysis from Intrusion Detection Systems (IDS)
To prevent signatures in IDS from triggering, use techniques such as altering TCP flags:
wireshark -i
Reporting
Exporting Captured Data
Export Wireshark captures for further analysis:
wireshark -r capture.pcap -w
Quick Reference Table
| Flag | Description |
|---|---|
| -D | List all available interfaces |
| -i | Specify the interface to capture on |
| -f | Apply a capture filter |
| -k | Start capturing packets immediately |
| -r | Read packets from a file |
| -w | Write packets to a file |
Pro Tips
- Use Coloring Rules: Set colors for different protocols to quickly identify malicious activity.
- Statistics Tools: Utilize the Statistics menu to gain insights into traffic patterns.
- Command Line Options: Use TShark for automated scripts and batch processing.
Real-World Examples
Capture and Analyze HTTP Traffic
To only capture HTTP traffic and save it for later analysis:
wireshark -i-f "tcp port 80" -w http_capture.pcap
Diagnosing Network Issues
To follow a specific connection for troubleshooting:
wireshark -i-f "host "