Guides

Wireshark Packet Analysis for Beginners (Defender View)

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

Wireshark is a packet analyser that lets defenders open a capture (PCAP) and see what happened on the wire — TCP handshakes, DNS lookups, clear HTTP, and TLS session setup. This guide teaches defensive reading of provided or sample captures only. It is not how to attack networks, poison ARP, or steal sessions.

Sample PCAP → open in Wireshark → filter → follow stream → notes → defend
No authorisation = do not capture
Encrypted TLS payload ≠ "broken Wireshark"

What do I need before this guide?

• A laptop you control with Wireshark installed (or a lab VM).
• A sample PCAP from Wireshark’s public sample captures, a course lab file, or a capture you took on your own isolated lab — never someone else’s traffic without consent.
• Optional: Firewall beginner, Nmap ethical basics (own lab only).

What does a defender look for in a PCAP?

Vertical clue list (concepts — not attack steps):

1. Who talked to whom — source and destination IPs and ports.
2. TCP — SYN/SYN-ACK/ACK (did a session start?), RST/FIN (how did it end?), retransmissions (trouble?).
3. DNS — which names were resolved? Unexpected domains after a phish click?
4. HTTP — cleartext methods, hosts, paths, user-agents (legacy or misconfigured sites).
5. TLS — Client Hello, Server Name Indication (SNI), certificate subject — proof that HTTPS was attempted to a named host.
6. Timing — bursts at odd hours; correlate with SIEM login times.
7. Baseline — normal lab browse vs sudden scan-like port chatter on your lab subnet.

How do I open a sample PCAP safely?

Step 1 — Get an authorised capture file

1. Download a public Wireshark sample or use a file your trainer shared for class.
2. Or capture on a host-only lab: browse your own lab web VM, stop capture, save .pcapng.
3. Store the file in a notes folder with date and scope line.

Step 2 — Open and orient

1. File → Open the PCAP.
2. Glance at the packet list: time, source, destination, protocol, info.
3. Statistics → Protocol Hierarchy (high-level mix of DNS/TCP/TLS/HTTP).
4. Do not panic if most payloads look binary — that is normal for TLS.

Step 3 — Use display filters (defender defaults)

1. dns — name lookups.
2. http — cleartext web (if any).
3. tcp.flags.syn == 1 && tcp.flags.ack == 0 — SYN starters (lab traffic patterns).
4. tls.handshake.type == 1 — Client Hello (TLS start).
5. Clear the filter between questions so you do not miss context.

Step 4 — Follow a stream (when cleartext exists)

1. Right-click a TCP packet → Follow → TCP Stream.
2. Read request/response text for HTTP labs.
3. For TLS streams, expect ciphertext — pivot to handshake fields instead of inventing decrypt shortcuts.

Step 5 — TLS clues without breaking crypto

1. Expand the Client Hello: note SNI (which hostname the client asked for).
2. Note certificate common name / SAN when visible in the handshake.
3. Record fingerprints only if your SOC playbook uses them — still defence notes.
4. Never ask coworkers for private keys “just to peek” outside an approved IR process.

Step 6 — Write the defender note

For every lab PCAP:

1. File name and optional hash for integrity.
2. Time range with timezone label (IST).
3. Top talkers and odd DNS names.
4. Cleartext findings vs TLS-only sessions.
5. Suggested blue action (block domain, reset user, patch host) — high level.

Real incident: Colonial Pipeline (2021) — remote access and visibility themes

Public reporting on the Colonial Pipeline ransomware event (2021) emphasised how critical infrastructure can be disrupted and how remote access and identity controls (including MFA on VPN-class paths) matter. Packet and flow visibility often sit beside those controls: when something odd happens on remote paths, defenders need logs and the skill to read captures from authorised sensors.

Takeaways (vertical):

1. What happened (theme) — operational disruption after a ransomware-related event; remote-access hardening became a loud public lesson.
2. Care-take — MFA and retire legacy VPN accounts (identity lesson).
3. Care-take — know what normal remote traffic looks like before an incident night.
4. Care-take — PCAP skill helps IR confirm what left or entered on networks you are allowed to monitor.
5. Care-take — practice on samples so panic nights are calmer.
6. Not in this guide — any ransomware deployment or VPN attack method.

Red Team vs Blue Team (awareness only)

Red Team — what attackers try (high-level)

• Hide in volume or blend with normal HTTPS.
• Prefer encrypted channels so cleartext HTTP filters stay quiet.
• Move using valid accounts so packets look “legitimate”.

Blue Team — defend, detect, respond

• Capture on approved span/TAP/EDR packet slices only.
• Correlate PCAP clues with SIEM identity and EDR process trees.
• Prefer blocking malicious domains / isolating hosts over chasing every encrypted byte.
• Keep sample PCAPs for training so new analysts learn filters safely.

How do I build Wireshark intuition step by step?

Step 1 — One sample, three filters

1. Open one public sample.
2. Apply dns, note three queries.
3. Apply http if present; note Host headers.
4. Apply tls; note one SNI value.

Step 2 — Map a lab browse

1. On host-only lab, capture while you open your own lab web page.
2. Find the TCP handshake to port 80 or 443.
3. Confirm DNS for the name you typed (if any).
4. Stop; never bridge that capture to the internet “to make it interesting”.

Step 3 — Tie to IR

1. Pretend a phish was clicked on a lab user VM.
2. List DNS names from the PCAP after the click time.
3. Write the containment note: which domain to sinkhole in lab DNS, which host to snapshot.

Care-take — stay a defender

1. Written permission or own lab — every time.
2. Minimise retention of captures that hold personal data.
3. Hash and label evidence files in real incidents.
4. Do not publish PCAPs that contain secrets from work tenants.
5. Pair with firewall / MFA / patching — packets alone do not save you.
6. Teach juniors filters before exotic plugins.

How do I fix common Wireshark beginner mistakes?

Ghabru naka 😅 — these are the usual ones: