CyberPatriot Resources · Resource 08
Wireshark & Packet Analysis
Use packet captures to observe network communication, isolate relevant traffic, reconstruct sequence, and correlate network evidence with activity on the host.
A packet capture shows what crossed the observed network point. It does not automatically explain intent, identify the responsible process, or prove a security incident.
Packet-analysis rule
Observe first. Filter second. Correlate before concluding.
Treat packets as evidence. Use filters to isolate relevant traffic, then connect network observations with host logs, processes, services, configuration, and competition requirements.
Official references
Wireshark User's Guide
The primary official guide for capturing, viewing, filtering, analyzing, and navigating packet captures.
Open reference →
Display Filter Reference
The official searchable reference for protocol fields that can be used in Wireshark display filters.
Open reference →
Display Filter Manual
Detailed syntax documentation for building Wireshark display-filter expressions.
Open reference →
Wireshark Resource Hub
Official Wireshark documentation, manuals, release notes, learning material, and technical references.
Open reference →
Packet-analysis vocabulary
Packet
A captured unit of network traffic containing protocol headers and, depending on the protocol, application data.
Frame
The Layer 2 representation of traffic, including source and destination MAC addresses when Ethernet is involved.
Protocol
A defined communication format such as ARP, DNS, TCP, UDP, HTTP, TLS, or ICMP.
Conversation
Traffic exchanged between endpoints, often grouped by addresses, ports, and protocol.
Flow
A sequence of related packets traveling between network endpoints.
PCAP
A packet-capture file containing traffic that can be opened and analyzed later.
Capture filters vs display filters
Capture Filter
Before or during packet collection
Limits which packets are recorded in the capture.
tcp port 443Traffic excluded by a capture filter was never saved, so it cannot be recovered from that capture afterward.
Display Filter
After packets have been captured
Controls which already-captured packets are currently shown.
tcp.port == 443A display filter hides unrelated packets from view without deleting them from the capture.
Useful display filters
tcpShow TCP traffic.
udpShow UDP traffic.
dnsShow DNS traffic.
icmpShow ICMP traffic.
httpShow traffic decoded as HTTP.
tlsShow TLS-related traffic.
ip.addr == 10.0.0.5Show IPv4 traffic where the address is either source or destination.
ip.src == 10.0.0.5Show traffic originating from one IPv4 address.
ip.dst == 10.0.0.5Show traffic destined for one IPv4 address.
tcp.port == 443Show TCP traffic using port 443 on either side.
udp.port == 53Show UDP traffic using port 53.
tcp.flags.syn == 1Show TCP packets with the SYN flag set.
What to analyze
Endpoints
Ports & Services
DNS
TCP
Protocols
Timeline
Packet-analysis workflow
01
Preserve the capture
Work from an authorized copy when possible and keep the original evidence unchanged.
02
Establish scope
Identify the systems, time range, addresses, and question you are trying to answer.
03
Survey protocols
Look at protocol hierarchy, endpoints, conversations, and overall traffic patterns before narrowing the view.
04
Apply display filters
Reduce noise using protocol, address, port, field, or value-based filters.
05
Inspect packet details
Expand relevant protocol fields and inspect the actual evidence rather than relying only on summary columns.
06
Correlate
Connect packet evidence with host logs, services, user activity, configuration, and scenario requirements.
07
Document the finding
Record endpoints, time, protocol, relevant fields, evidence, and what the observation actually supports.
Useful Wireshark features
Protocol Hierarchy
Summarizes the protocols found in the capture and their relative volume.
Endpoints
Lists observed network endpoints and helps identify heavily active systems.
Conversations
Groups traffic exchanged between pairs of endpoints.
Follow TCP Stream
Reconstructs the data exchanged in one TCP conversation when the protocol and capture allow it.
Expert Information
Highlights notable protocol conditions, but should be interpreted as clues rather than automatic security conclusions.
Packet Details
Expands protocol fields so you can inspect addresses, ports, flags, lengths, identifiers, and other evidence.
Investigation situations
A workstation contacts an unfamiliar host
Filter on the workstation address.
Identify the remote destination.
Determine the protocol and destination port.
Review timing and connection frequency.
Check DNS activity that may have resolved the destination.
Correlate with host processes and logs before drawing a conclusion.
A service appears unreachable
Confirm whether traffic leaves the client.
Look for a response from the destination.
Review TCP handshake behavior when TCP is involved.
Look for resets, retransmissions, or ICMP errors.
Compare packet evidence with routing, firewall, and service state.
DNS behavior looks unusual
Filter on DNS traffic.
Identify the requesting system.
Review query names and response records.
Look for repetition, failures, or unexpected destinations.
Correlate the DNS event with later connections.
You suspect unexpected listening activity
Identify relevant inbound connection attempts in the capture.
Determine destination port and protocol.
Compare the evidence with the host's listening sockets.
Map the socket to its owning process or service.
Use host evidence to determine whether the activity is approved.
Weak interpretation vs better interpretation
Weak interpretation
Port 443 means the traffic is definitely safe HTTPS.
Better interpretation
Port numbers are clues. Verify protocol decoding, endpoints, certificate information when available, and surrounding evidence.
Weak interpretation
A red or black packet means an attack occurred.
Better interpretation
Wireshark coloring is a visualization aid. Inspect protocol fields and context before interpreting the packet.
Weak interpretation
A TCP reset proves malicious behavior.
Better interpretation
A reset can occur for many operational reasons. Correlate it with the connection state and host evidence.
Weak interpretation
One unusual DNS query proves compromise.
Better interpretation
Review repetition, requesting host, response, later connections, and host activity before concluding anything.
Weak interpretation
Capture everything forever.
Better interpretation
Use authorized captures, defined scope, reasonable collection windows, and evidence-preservation practices.
Weak interpretation
Packet evidence explains which process created the traffic.
Better interpretation
Network captures show communication. Correlate with host evidence to identify the responsible process or user.
Packet evidence note
Time
When did the packet or conversation occur?
Source
Which system initiated or sent the traffic?
Destination
Which system received the traffic?
Protocol
What protocol was observed?
Ports
Which source and destination ports were involved?
Filter
What display filter isolated the evidence?
Observation
What can directly be seen in the packets?
Correlation
Which host logs or system evidence support the interpretation?
Conclusion
What does the evidence support without overstating it?
Wireshark resource checklist
Use Wireshark's official documentation and filter reference.
Know the difference between capture filters and display filters.
Preserve original packet captures when treating them as evidence.
Establish scope before investigating individual packets.
Survey endpoints, conversations, and protocols before narrowing.
Use display filters to reduce noise without deleting evidence.
Inspect actual protocol fields instead of relying only on colors.
Correlate ports with protocols and host evidence.
Review both directions of a conversation.
Use timestamps to reconstruct sequence.
Correlate packet findings with logs, processes, services, and configuration.
State only what the packet evidence actually supports.