We will touch on Ubuntu Linux, Centos and Windows. Wireshark will run on a variety of operating systems and is not difficult to get up and running. Continue reading through the tutorial and start getting more from this powerful tool. These examples only scratch the surface of the possibilities. Troubleshoot vulnerability checks to understand false positives and false negatives.Understand what network traffic the vulnerability scanner is sending.Extract large DNS responses and other oddness which may indicate malwareĮxamination of Port Scans and Other Vulnerability Scan types.Filter out the 'normal' and find the unusual.Use IO graphs to discover regular connections (beacons) to command and control servers.Search for unusual domains or IP address endpoints.Detect anomalous behaviour that could indicate malware.Similar to the HTTP export option but able to extract files transferred over SMB, the ever present Microsoft File Sharing protocol.Export objects from HTTP such as javascript, images, or even executables.Ack of server acknowledging the request.Troubleshoot DHCP issues with packet level data View SMTP or POP3 traffic, reading emails off the wire.View Telnet sessions, see passwords, commands entered and responses.View full HTTP session, seeing all headers and data for both requests and responses.Here are a few example use cases: Troubleshooting Network ConnectivityĮxamination of Application Layer Sessions (even when encrypted by SSL/TLS see below) Wireshark can be useful for many different tasks, whether you are a network engineer, security professional or system administrator.

The -A option of tcpdump prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line: tcpdump -A -r stackoverflow.cap > stackoverflow.txt

Use wireshark command line