Wireshark is one of the most powerful network traffic analyzers for both Mac and Windows. I'm going to show you how to use it to view the traffic on your network, analyze packet data, and identify any problematic or malicious activity. This video is an update to a Wireshark tutorial that I published over 8 years ago.
Since then, I've learned a lot more about Wireshark and cybersecurity in general. So let's get into it. Wireshark is free to download and use for both Mac and Windows.
When you first install it, there's an additional package that you also have to install, at least on Mac, so just make sure to read the readme files that you see when you first download it. Now once it's installed and open, you can immediately see in the capture section which network interface cards are picking up traffic. You obviously have to be connected to the networks that you want to look at with the device, the computer that you're using.
Generally speaking, you're going to want to look at your Ethernet or your Wi -Fi. Depending on your hardware setup, it can be difficult to sniff the packets on a Wi-Fi network. Mac users should be totally fine.
They have been for a long time with Wireshark able to do that. There has been some issues with Windows in the past. So to get started and just to jump right in and make sure we're getting good data, let's just double click on Ethernet to take a look.
When we double click, immediately Wireshark starts capturing packets and we can let it go and capture packets for as long as we'd like. So if you're troubleshooting a particular website or something like that, you'll want to try and access that website now while it's capturing. And then once you think you have enough data, once enough time has gone by, you can go ahead and you can click on the red stop button up here at the top left.
So now we have some information to work with. You can see at the very bottom of the screen, it tells us that it captured 242 packets and of those, all of them, 100% of them are currently being displayed. But as we filter things here in Wireshark, we'll probably drill that down so we're not seeing all of them at once.
Each of the rows that you see on the screen is a single packet of information. Whenever information is transferred over a network, it's transferred via packets. That means that every time you load a webpage, every time you upload or download something, packets of information are being transferred between your computer and a web server.
There are also a bunch of packets, especially nowadays, that are being transferred at any given time, especially as all of your IoT devices, your smart devices, communicate with each other and the router to make sure that they still have a connection. Because of this, one of the major challenges of Wireshark and doing network audits in general is sifting through all of the unimportant stuff, or at least the stuff that 's not important right now. So I'm going to show you how we can get a bird's eye view of really just everything that's going on here in Wireshark and then how we can go from there and filter things out to drill down and find exactly what we're looking for.
The first thing I like to do when looking at a new packet capture or a PCAP as it's known as, is to go up here in Wireshark and go to the statistics dropdown. Now there are some really cool statistics in here. I'm not going to go through all of them.
I'm going to go to one particular, but do note that this menu exists and it 's a really good place to go if you're looking for general information on stuff, especially like this capture file properties. This shows the properties of the entire PCAP that you have in front of you. But what I want to do is I want to click on this conversations option.
Now when I do that, this window pops up here in Wireshark and I can now see all of the conversations that are part of the PCAP that I just captured. So I can see, we have some tabs up here at the top to go through the different protocols. So I could for instance go to the TCP protocol and I can see that this particular IP address was communicating with, this happens to be my computer's IP address, and they sent 591 bytes in this conversation.
We can see how many packets were sent from A to B3, from B to A4, and how large those packets were, the duration of the conversation, and all of this really cool information. I should mention that any time you're doing network analysis, it's a good idea to know some of the IP addresses on your network. So for example, I know that my computer is 192.
168. 1. 220.
You can find that out just by going to your network settings on your computer, whether it's Mac or Windows, it'll be right in there. You also might want to know the IP address of your router. And if there's a particular device that you're trying to troubleshoot, it's a good idea to know maybe the Mac address of that device so that you can find it and see if it's even accessing the network at all.
One thing to look for in this section is you could look and see if your computer, so looking at your computer's IP address, is having any long conversations with an unknown device. If you see that happening, you could then dig a little bit deeper in Wiresh ark and try and discover what the purpose of the communication is or what device it's trying to communicate with. And actually, that brings up a good point, and I want to step back for a second.
You see, Wireshark is an incredibly powerful tool, but it's kind of like an open world sandbox game. It's better used with a particular goal in mind. So some examples include a device not working on your network, and maybe you can use Wireshark to see if there's any communication at all.
Maybe someone at your organization thinks they've been phished, so you want to reopen the link that they got in the sketchy email while capturing with Wireshark, obviously on a safe machine, to see what information can be gathered. Or more simply, maybe just to see what devices are constantly communicating on your network to see if you can improve your bandwidth. Wireshark can help with all of these situations, but the filters that you use and the packets that you focus on will be different.
So the rest of this video will be focused on helping you learn how to use W ireshark from a general perspective so that you can then start to learn on your own and seek tutorials specific to your situation. Okay, back to the conversation statistics pop-up where we left off. Here is where some Wireshark awesomeness happens.
You see, I brought you here to get a bird's eye view of everything that's going on in Wireshark, but we can actually use this screen to start filtering our packets. So what we can do is we can find an IP address that we want to, let's say we want to look at all the packets to and from a particular IP address. So I have my IP address and I want to find where it's in this address A field.
It's just going to make it a little bit easier for us. And then I'm going to right click on my IP address and I'm going to go to apply as filter. And then I'm going to go to selected and we have a number of different options in here.
I'm just going to quickly go over them a little bit so you kind of have an idea of what's going on. But you'll notice that the first one will filter on this particular conversation stream. So just this entire conversation.
The A, B with the two arrows will filter any packets that were sent between both A and B. The A arrow to B will show any packets sent from A to B. The next one is any packets B to A.
And then we've got this one, A is either sending or receiving from any IP address. And that's the one that we're actually going to use. But you can kind of use which one is specific to your situation.
So when I click on this, you'll notice that a filter is now automatically put up here in the top. And because we have the port in here as well, the filter included the port, which I don't really want for this particular situation. So I'm just going to close out the conversation window.
And then I can go into my filter and I can just delete out that port number part. So we can see it says IP. addr=192.
168. 1. 220.
That is how you can find any packets that were sent either to or from that IP address. You could have typed this in manually, but I showed you how you can do it a little bit easier by right clicking and applying those filters. You can do that from anywhere in Wireshark.
So you can right click in here and you can apply filters. You can follow conversations, which we're going to look at in a second. But just don't be afraid to use that right click.
There's a lot of valuable options from there. Now before we go any further, let's capture a more interesting PCAP so that we have some additional data to work with. So what I'm going to do is I'm just going to go up here and I'm going to go to the file menu.
I'm on Mac on Windows. Just click on the drop down menu and you're just going to close this particular PCAP. And it's going to ask you, do you want to save it?
You can save your PCAPs. You can export them to open them up and send them to people. We don't want to save this.
This wasn't important. So I'm going to hit continue without saving. It brings me back to the initial screen.
Now I'm going to start a new capture, but I'm going to be prepared and I'm going to load up a couple of websites while I do that capture so that we have some better data in there. Okay, so we will double click on Ethernet. And now I'm just going to load this one website.
And I'm going to load this other website. Make sure that one's actually loading. Okay, so I've loaded a couple of websites.
Now let's go ahead and hit stop. Now notice that we still have this filter up here. So I'm just going to delete that out so we can see everything.
So we can see we captured, if we look at the bottom, 5,536 packets. All of them are currently being displayed. So now what?
Well, it depends what you're looking for. But let's talk about looking for some general stuff. So first of all, in this filter bar, one thing that you can look at is if you're kind of afraid that somebody got hacked or phished or there's something sketchy going on, usually that is done over unsecure servers and networks and connections.
So you might want to look at HTTP and not encrypted level HTTPS. So in your filter here, you can just type HTTP. And you'll notice when it turns green, it means that it is an accepted equation filter.
If it's red, it's not going to work. So you need to try and figure it out. But it's green, so we can hit enter.
And now we're seeing all of the HTTP requests. Now this happens to be from the website that I loaded that was insecure. It was HTTP.
I want to show you something interesting about this. So notice, we can just click on really any of these packets. And we start to see this information down here at the bottom.
So let's close up some of these. I have these all open. But I think it'll be easier if we see it from a little bit of a higher level .
So you can see within this packet, we've got a number of different protocols that are encapsulated. We've got Ethernet, TCP, and then we've got HTTP. So this is the one that we're kind of looking at when we search for this.
And if we notice that Wireshark kind of highlights in blue things that you might find interesting here in Wireshark. So if we can drill this down, we can open this up. And you'll notice that we start to see information about what was happening here.
So we can see it was accessed via Macintosh and Intel Mac OS. We can see what browser was used. So what we can actually do is we can actually just right click on one of these packets up here.
And we can go to this follow option, which is used quite a bit here. And we want to follow the HTTP stream. And this will pop up a new window for us that essentially shows us all of the information that was sent in these packets.
Now the reason I'm showing you this HTTP is because if you were looking at a packet sent over an encrypted connection, you wouldn't really be able to read anything. A few little things, you would be able to probably see the computer type that it was sent on and all that stuff. But notice what we've got here.
We have this entire web page. This is the web page I went to. It's here in Wireshark now.
I could put this into a compiler, an HTML compiler, and it would print out the web page. So we've got everything in here. So what this means is this is how phishing works.
So the way phishing works is somebody sends you a link that maybe looks like your Bank of America link or a social media link. Oftentimes they have a reason. Maybe they know you're using Bank of America.
So they're trying to trick you. They're targeting you. And you open up that link.
And that link happens to look just like a Bank of America page, but it's not . It's a page that they built. They can build them super fast.
And it's now over an HTTP connection. So you enter your username and password. That person who's phishing you now can go in here to Wireshark if they're tapped into the network.
And they can see your username and password that you entered right here in W ireshark. So that is how an easy phish hack actually works. You do it with Wireshark, but you can also see if it's happening with Wiresh ark.
So I just wanted to show you that. And so we've got this entire web page here. So we can close this out.
We drilled all the way down and saw everything that was transferred in that packet. And now we're seeing the-- because we opened that up and we followed that stream, we're seeing all of the packets that were exchanged within that stream. So that's awesome.
But how can we look at secure traffic? Well, to look at insecure traffic, we're using HTTP. To look at secure traffic, we actually have to use TCP, but a specific port.
And that's usually port 80. It can also be port like 8000, 8001, 8002. But generally, you're going to be looking at port 80.
So what you would want to do is you would type TCP. port and then == 80. And then hit Enter.
And this will show you all of the packets that were sent on TCP port 80, aka encrypted traffic. When we start to look at the actual data within these packets, we can't read it because it's encrypted. Now, if you had the encryption key, you can actually upload that in here to Wireshark and you can decrypt it.
So if you're doing some hardcore security on an organizational network and you want to test things and you want to be able to see the data that's being sent or not sent here in Wireshark, you can upload your encryption codes to Wireshark so that you can actually see that. That's very advanced, though. So we're not going to look at that in this video.
Now, since we've been doing some different filters and stuff, I want to show you how to create a button here in Wireshark. So we did this filter to show all the traffic on port 80. What we can do is instead of having to type that every time, we can go over here to the right side of the screen and click on the plus icon.
Now it allows us to create a filter button. So we can just call this like HTTPS or we can just call it port 80, whatever we want to call it. We can enter some comments.
We can change the filter over here if we wanted to, but then we can click OK . And now we have this nice HTTPS button over here. So if we were to delete out our filter and view everything that we've captured and click HTTPS, boom, there we go.
So we've now created our first button. And I'm going to give you a bunch of filters here towards the end, and you should probably create a button for all of them because they're really commonly used filters . Okay, let's clear out this filter.
Let's start to talk about some coloring rules here in Wireshark. You've probably noticed I have some black lines, purple, green. What do they all mean?
Well, the easy way to find out is we want to go up here to the view menu and we want to go to coloring rules. And here you can see and modify if you want to all of the coloring rules here in Wireshark. So you can see black has to do with bad TCP, red has to do with aborted handshakes and that sort of thing.
So you can kind of get an idea. I'm going to show you some filters that might help you kind of see these, specifically these on your own network as well. But anytime you're wondering what exactly the coloring stands for, this is where you can find it and where you can modify it if you'd like.
So if we scroll down here a little bit, let's go. You'll notice on the right side of the scroll bar, we can kind of see the coloring as well. So these are things that Wireshark is highlighting.
It's an analysis tool. So it captures the information, which a lot of different tools can do. But then Wireshark runs its own analysis on that information and that's where these colored lines come through.
These red ones and black ones, Wireshark is saying, "Hey, there might be something here. " It's not like, "Hey, this is guaranteed malware. You're in trouble.
" This is, you might want to take a look at this. If you're looking for something on this network, these are good places to start. So we can see we've got maybe some spurious retransmissions.
This often happens at the beginning of a capture. You'll notice as the capture went on, it kind of stopped. So I wouldn't really worry about that, but I know people do ask in my other tutorial, people asked about that a lot.
But I'm going to show you how you can find those a little bit easier later. I'm going to show you a filter that will only pull out the Wireshark flag. So we'll get back to that.
But one thing I want to do is I want to do two quick things here. First of all, is I want to show you the preferences real quick. So in Mac, I'm going to go up to Wireshark and go to preferences.
But if you're using Wireshark, I'm sure you can find out how to get in the preferences on Windows too. So go into your preferences. And then within here, there's a cool option within the layout section.
So you can change how your windows are laid out. So by default, we have this one, two, three, which works pretty well. But one thing that is kind of a newer feature of Wireshark that people like to see sometimes is instead of in this third field, seeing the packet bytes, there's actually an option to see the packet diagram.
And if you enable that, you can actually see how this packet is structured. I think this is really good, especially for educational purposes. So you might want to poke around in Wireshark a little bit to see the actual structure of the packet, how many bytes it is, how the bytes are structured, that sort of thing.
But so yeah, that's a cool option as well. Another thing that I want to show you is how to add delta time here in Wires hark. So we have all of these columns up across the top, but they're completely customizable.
So I can just go to my preferences again. And this time I'm going to go to appearance and then columns. You'll notice that we can click the plus icon to add new columns.
So I could give this a name, say, call it delta. Well, I'll just call it delta. And then we can double click in this type field and choose the type.
We want delta time. So you can see you've got a number of different options. And then I can just, I can actually drag this field where I'd like it.
So I don't want it at the end. So we'll click OK. You'll notice we now have the delta field so we can see delta time as well here in Wireshark.
Okay, so now we've gone through a lot of the user interface and we've modified some settings. So now I'm going to show you a bunch of useful filters. I'll warn you though, this section of the video is probably more helpful for advanced users or at least once beginner users have played around a bit and are looking for some specific information.
So the first filter is a general filter that will hide less commonly looked at protocols. So to do this, we're going to go up here and we're going to do exclamation point. Then we're going to do open parentheses and we're going to add all the filters that we don't want to see.
So ARP or ARP or STP or LLDP or I guess CDP. And then we're going to close the parentheses. And right now, if we look at the bottom of Wireshark, we're displaying 5,536 .
Open that filter and we've taken out, you know, only 11 because like I said, those aren't looked at that much. But this will kind of clear it up a little bit depending on how long your capture file is. So you might want to add that one as a button.
Now the next one that we're going to look at is to see all of your TCP SYN flags, aka the first part of the three-way handshake. So this is when connections are being opened. So we're going to go up here to the filter field.
And for this one, we're going to do TCP. flags. And we're going to, we can actually click and choose it.
We don't have to type it all out. Flags. SYN==1, enter.
These are all of our, the first part of our three-way handshakes. So again, if you're, if you know what you're doing with network security, hopefully you find this helpful. I think you, you know, you know what I'm trying to show you here.
So that one might be another good button as well. The next filter is the one that I told you about earlier. How can we see just the stuff that Wireshark flagged?
We can go up here. And for this one, we can do TCP. analysis.
flags. And you'll notice that now we're only seeing the flagged packets from Wiresh ark. For those of you who like really are just using it for the first time and you're like worried that there's something going on in your network or something, you might want to start here.
There's probably nothing. I don't think, you know, looking through here, I don't, these are just kind of dropped packets and things like that. Retransmissions, fast retransmissions, spurious retransmissions, but they're not like a ton of them at once.
So you know, this isn't that concerning, but it's a good place to look if that's what you're looking for. To see if there are any specific packets that are from like an abortive release, aka one of your devices said, no, I'm not talking to you, go away, which is often a red flag. We can use the filter that is TCP.
flags. reset==1. You can see it's auto-filling for me.
So I do have a few of those. So you know, this is definitely something to potentially look at. So obviously there are a ton of filters that you can use and you can even get really creative with your filters here in Wireshark, but these filters should help you get started in digging deeper.
Like I said, it all depends on what you're looking for. If you want to see some examples of malicious network activity, you should check out this website, malware-traffic-analysis. net.
They have a bunch of PCAP files available for download. So you can just kind of click here in this traffic technical analysis. For each PCAP on the site, they give you some objectives so you can go in and investigate and try and figure it all out, which gives some structure to the open sandbox world of Wireshark and then they provide an explanation of how they got to the answers that are the correct answers.
So this is great practice for anybody looking to get into cybersecurity. And I know that there are plenty of cybersecurity programs that actually have their students use these exercises. So that's how good it is.
I hope that you now have an idea of how to get into Wireshark, capture some network data, and then start drilling down to exactly what you're looking for. If you found this video helpful, I would really appreciate a thumbs up here on YouTube. If you want to see more content like this, don't forget to subscribe to the channel.
Good luck analyzing the PCAPs and defending your network. I'm Anson Alexander and I will see you in the next one.
