Wireshark: Analyzing Network Packets

Wireshark captures network traffic and shows every packet in detail. For the command line there is tcpdump.

Starting a capture

sudo tcpdump -i eth0 -w capture.pcap
sudo tcpdump -i eth0 port 443

The .pcap file can be opened and analyzed in Wireshark.

Important filters

  • ip.addr == 192.168.1.10 — traffic of one IP.
  • tcp.port == 443 — HTTPS only.
  • http — HTTP requests/responses only.
  • dns — DNS queries.
  • tcp.flags.syn == 1 — SYN packets.

Typical troubleshooting

  • Slow connection: count TCP retransmissions (filter: tcp.analysis.retransmission).
  • Lost packets: Statistics > TCP Stream Graph.
  • Unknown traffic: Statistics > Conversations.

Important

Recording other people's traffic can be illegal. Only capture your own traffic or with permission.

See also: Networking.