24. Traffic Sniffing and Analysis
24.3 Wireshark: Reading Traffic in a GUI
Wireshark is the standard graphical packet analyser. Start it, pick an interface, and watch packets arrive; or open a .pcap from tcpdump.
wireshark # GUI (ships with Kali)
# to capture without root in the GUI, add your user to the wireshark group once:
sudo usermod -aG wireshark $USER # then log out and back in
The window has three parts: the packet list (one row per packet), the packet details (protocol layers you can expand – Ethernet, IP, TCP, HTTP), and the packet bytes (raw hex). Colours group protocols; the columns show source, destination, protocol and info.
Ravindra Bagale's Tip
Wireshark ughadlyavar hajaro packets baghun students ghabartat. Ghabru naka – konihi sagle packets vachat nahi. Filter lava (pudhcha section) ani fakt je hava te bagha. Wireshark shikne mhanje filters shikne.
Lab
Open web.pcap from 24.2 in Wireshark. Expand one HTTP packet and identify the four layers (Ethernet, IP, TCP, HTTP). Note the source and destination IP and the TCP ports.