Unit 7: Reading captures in Wireshark · Lesson 1 of 6 · 15 min
Wireshark's three panes
Open a capture in Wireshark, filter it and find your way around the window.
mission
- You are
- The analyst onboarding to the team's tools.
- Situation
- Wireshark opens on your lab desktop with http.pcap loaded. Everyone on the team uses it, and screenshots of it end up in reports.
- Goal
- Learn the window well enough to find any packet, field and byte quickly.
- Hand in
- The frame number of the login POST.
Wireshark as a flight recorder
Filter the packet list
Click the filter bar, type http.request and press Enter. The bar turns green when the filter is valid.
you should see Three packets: two GETs and one POST.
Expand the details
Click the POST and expand HTML Form URL Encoded in the details pane. Click a field and watch the bytes pane highlight it.
you should see The username and password, with their raw bytes lit up below.
defender tip Right-click any field and choose Apply as Filter. It writes the filter for you, which is the fastest way to learn field names.
Check it on the command line
The same display filter works in tshark, so every click can become a repeatable command for your report.
tshark -r http.pcap -Y 'http.request.method == "POST"'
14 4.502800 10.10.0.23 → 10.20.0.40 HTTP 300 POST /login HTTP/1.1 (application/x-www-form-urlencoded)
Display filters worth knowing
| Command | What it does |
|---|---|
http.request | HTTP requests |
ip.addr == 10.20.0.40 | Anything to or from one host |
tcp.port == 80 | Anything on one port |
dns.flags.rcode == 3 | DNS answers that said NXDOMAIN |
tls.handshake.type == 1 | TLS Client Hellos |
!(arp or dns) | Hide the noise |
Count what a filter keeps
Wireshark's status bar shows displayed and total packets. On the command line, count the lines.
tshark -r http.pcap -Y http | wc -l
6
you should see 6 HTTP packets: three requests and three responses.
What a defender takes away
- 1Filter bar, packet list, details, bytes: top to bottom, summary to raw.
- 2Apply as Filter teaches you field names as you click.
- 3Repeat every GUI finding as a tshark command for the report.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.