🛠Security Tool Cheatsheet
Sarah Chen — SOC Analyst & Tool Specialist
What is Wireshark?
Wireshark is an open-source network protocol analyzer that allows security analysts and penetration testers to capture and interactively browse the traffic running on a computer network. It is widely regarded as one of the most powerful tools for network troubleshooting and analysis.
Installation
Wireshark can be downloaded for various operating systems including Windows, macOS, and Linux. Visit the Wireshark download page to get the latest version.
Basic Syntax
The basic syntax for Wireshark usage involves launching the tool with various options to customize the capture and analysis:
wireshark [options] [capture_file]
Discovery
Capturing Live Traffic
To capture live traffic from a specific network interface, use the following command:
wireshark -i eth0
Here, -i specifies the interface. Replace eth0 with your desired interface, which can be listed using wireshark -D to show all interfaces.
Scanning
Using Capture Filters
Capture filters can help you limit the amount of data collected to what is relevant. For example, to only capture HTTP traffic, use:
wireshark -i eth0 -f 'tcp port 80'
Exploitation
Following TCP Streams
After capturing traffic, right-click on any packet and select Follow > TCP Stream to view the complete conversation between hosts, which can be crucial for analysis.
Analysis
Analyzing Protocols
Use the display filter http to view only HTTP packets:
wireshark -i eth0 -Y 'http'
Evasion
Using Stealth Capture
To run Wireshark in a non-GUI environment which can help in evading detection systems:
tshark -i eth0 -w capture.pcap
Reporting
Exporting Captured Data
To export captured data in various formats, employ:
wireshark -r capture.pcap -Y 'http' -T fields -e http.request
This command will read the capture.pcap file and export HTTP request-related fields.
Quick Reference Table
| Flag | Description |
|---|---|
| -i | Specify network interface |
| -f | Set capture filter |
| -Y | Set display filter |
| -r | Read specified capture file |
| -w | Write captured packets to file |
Pro Tips
- Color Rules: Set custom color rules for easy visibility of specific protocols.
- Shortcuts: Learn shortcuts like Ctrl + E to export packets or Ctrl + F to filter.
- Statistics: Use Statistics > Conversations to analyze traffic quickly.
Real-World Examples
- Capture All Traffic From a Specific IP: Use the filter:
- Exporting to CSV: To save a report for HTTP requests:
wireshark -i eth0 -Y 'ip.src==192.168.1.1'
tshark -r capture.pcap -T fields -e http.request > report.csv
Use these commands effectively to enhance your network analysis capabilities. Happy capturing!