Network Traffic Analysis: Deep Packet Inspection with Wireshark

Where Nmap tells you what doors and services are open on a network, Wireshark allows you to see every single byte moving across the wire in real time. As the world's foremost open-source packet analyzer, Wireshark captures raw frames from network interface controllers (NICs) and decodes hundreds of protocols down to individual header bits, making it indispensable for network troubleshooting, malware traffic analysis, and digital forensics.

How Packet Sniffing Works: Promiscuous Mode

Under normal operating conditions, a computer's network interface card operates in Non-Promiscuous Mode: it inspects the destination MAC address of incoming frames and immediately discards any frame not addressed specifically to its own hardware MAC or broadcast address. When Wireshark begins capturing, it switches the NIC into Promiscuous Mode, instructing the hardware to capture all network frames traversing the local physical link regardless of destination.

Top Wireshark Display Filters for Security Analysts

Raw packet captures often contain hundreds of thousands of frames. Display filters allow analysts to slice through noise and pinpoint suspicious activity instantly:

The Power of "Follow TCP Stream"

Raw packet logs can be disorienting because individual packets appear interleaved out of order. Wireshark's Follow TCP Stream feature reassembles TCP sequence numbers and displays the entire human-readable bidirectional conversation in a single clean window:

POST /login.php HTTP/1.1
Host: testphp.vulnweb.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded

uname=admin&pass=SuperSecretPassword2026

HTTP/1.1 200 OK
Set-Cookie: session_id=98a7bc34ef12; Path=/

# Capture 100 packets on eth0 and save to pcap file
sudo tcpdump -i eth0 -c 100 -w capture.pcap

# Inspect live HTTP POST requests using tshark
sudo tshark -i eth0 -Y 'http.request.method == "POST"' -T fields -e ip.src -e http.request.uri