Ravindra BagaleCourses & study guides मराठी Track your progress

24. Traffic Sniffing and Analysis

24.3 Wireshark: Reading Traffic in a GUI

By Last updated:

In short: Wireshark is the standard graphical packet analyser.

Wireshark is the standard graphical packet analyser. Start it, pick an interface, and watch packets arrive; or open a .pcap from tcpdump.

wireshark            # GUI (ships with Kali)
# to capture without root in the GUI, add your user to the wireshark group once:
sudo usermod -aG wireshark $USER      # then log out and back in

The window has three parts: the packet list (one row per packet), the packet details (protocol layers you can expand – Ethernet, IP, TCP, HTTP), and the packet bytes (raw hex). Colours group protocols; the columns show source, destination, protocol and info.

Ravindra Bagale's Tip

When they open Wireshark and see thousands of packets, students panic. Don't worry – nobody reads every packet. Apply a filter (next section) and look only at what you need. Learning Wireshark means learning filters.

Lab

Open web.pcap from 24.2 in Wireshark. Expand one HTTP packet and identify the four layers (Ethernet, IP, TCP, HTTP). Note the source and destination IP and the TCP ports.

Wireshark for defenders

Use Wireshark on traffic you are allowed to capture: your lab, your own NIC, or a span/mirror port you control.

  1. Filter http or tls.handshake.type == 1 to see cleartext vs encrypted sessions.
  2. Prove why HTTPS matters by comparing a lab HTTP login vs HTTPS.
  3. Export objects only from lab captures.
  4. Use findings to justify TLS everywhere and to ban cleartext protocols on your servers.

Real examples

Global: Wireshark is a standard tool in NOCs and IR teams. Indian company (sample): a college network team used a capture to show students why Telnet passwords appear in plain text, then disabled Telnet.

Common mistakes

  • Capturing on office Wi-Fi without authorisation.
  • Sharing PCAP files that contain real personal data.

Recap

  • Capture only what you may.
  • Turn findings into TLS and protocol hardening.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.