Wireshark Packet Analysis Mastery: Inspecting Protocols, Handshakes, and Malicious Traffic
A practical guide to capturing, filtering, and dissecting raw network packets to detect cyber attacks and troubleshoot network infrastructure.
1. The Role of Packet Sniffing in Cyber Defense
While application logs tell you what software thinks happened, raw packet captures (.pcap / .pcapng) provide mathematically undeniable ground truth.
Every network transaction—from a user authenticating over HTTPS to an advanced persistent threat (APT) exfiltrating sensitive records—leaves an indelible packet footprint.
2. Capture Filters vs. Display Filters
One of the most frequent points of confusion for beginners is the difference between capture filters and display filters.
Capture filters use Berkeley Packet Filter (BPF) syntax and are evaluated by the capture engine before packets are written to memory. Display filters are applied post-capture inside Wireshark's GUI to slice and dice existing captures without discarding data.
# Capture Filter (BPF Syntax - set before capture):
host 192.168.1.50 and port (80 or 443)
# Display Filter (Wireshark GUI Syntax - set while analyzing):
http.request.method == "POST" || tcp.flags.syn == 1 && tcp.flags.ack == 0
ip.addr == 10.0.0.15 && dns.flags.response == 13. Dissecting the TCP Three-Way Handshake
Before any application data (such as an HTTP GET request) can travel across a TCP connection, the client and server must establish sequence synchronization.
Step 1 (SYN): The client sends a packet with the SYN flag set and an initial sequence number (ISN).
Step 2 (SYN-ACK): The server acknowledges the request with ACK = client_ISN + 1, and transmits its own SYN sequence number.
Step 3 (ACK): The client confirms receipt with ACK = server_ISN + 1. The socket is now in the ESTABLISHED state.
4. Spotting Malicious Indicators in PCAP Files
Defenders analyze Wireshark streams for anomalies such as SYN Floods (thousands of unresolved SYN packets with no matching ACKs, indicative of DoS attacks).
Another high-priority indicator is abnormal DNS traffic: high-entropy domain queries (e.g., `x7a9k2b8c9.malicious-domain.com`) often signify DNS tunneling or command-and-control (C2) beaconing.