Packet Analysis (Wireshark)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Packet Analysis (Wireshark) without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

Wireshark captures every packet passing through a network interface and breaks it down by protocol layer (Ethernet, IP, TCP, HTTP) — it's useful for network troubleshooting (finding connection issues), security analysis (spotting suspicious traffic), and learning protocols (watching an actual TCP handshake at the packet level). Using a filter (`http`, `ip.addr == 192.168.1.1`) lets you pick out exactly the traffic you want from a sea of packets.

Let's connect it to a real scenario

Log in through an unencrypted HTTP login form on your lab VM — filter for `http.request.method == "POST"` in Wireshark and you'll be able to see the username/password sitting right there in plain text inside the packet (a real risk if HTTPS isn't used). This demo is a visually convincing proof of exactly why HTTPS/encryption matters.

Wireshark = a packet analyzer tool for capturing/analyzing network traffic
You can view the protocol layer breakdown (Ethernet/IP/TCP/HTTP) for each individual packet
Filters (http, ip.addr == ...) let you pick out exactly what you want from a huge amount of traffic

Let's look at an example together

text

Useful Wireshark filters:

http                          — show only HTTP traffic
http.request.method == "POST" — show only POST requests
ip.addr == 192.168.56.101     — show traffic to/from one host
tcp.port == 22                — show only SSH traffic
dns                           — show only DNS queries

You should see

You should see only traffic matching your filter appear in Wireshark's packet list panel.

Try it in 5 minutes

Start a Wireshark capture and log in through your lab VM's unencrypted HTTP login form — use the filter `http.request.method == "POST"` to find the credentials sitting inside the packet.

A quick word of caution

Running Wireshark on a shared network (office WiFi, public WiFi) without authorization amounts to eavesdropping on other users' traffic and can violate privacy laws — only practice this on your own lab network.

Easy traps

Capturing traffic on a production/real-world network without authorization — you can end up capturing other users' private traffic, raising privacy/legal issues
Assuming Wireshark can read HTTPS traffic as plain text — since it's encrypted, you can't read the content without the decryption key

Now try it yourself

Start a Wireshark capture and log in through your lab VM's unencrypted HTTP login form — use the filter `http.request.method == "POST"` to find the credentials sitting inside the packet.

You'll know it worked when: You should see only traffic matching your filter appear in Wireshark's packet list panel.