macOS

The official macOS Wireshark package bundle (.dmg) can be downloaded from the Wireshark download page, and contents can be copied to the /Applications folder.

A screenshot of the ChmodBPF package path includes Wireshark, authors, folders, plugins, keyboard shortcuts, acknowledgments, and license options. Selected the folders options, which include the name, location, and typical files.

The ChmodBPF and system path packages are included along with the Wireshark installer package.

Linux

Command-line installation varies based on Linux distributions. We have covered examples for Red Hat and Debian types, but other variants will follow the standard install approach.

Windows Install

The Wireshark installer can be downloaded from www.wireshark.org/download and executed. During the installation, several optional components and the location of the installed package can be selected. For most users, default settings will work and are recommended.

On 32-bit Windows, the default install path is “%ProgramFiles%Wireshark”, and on 64-bit Windows, the default install path is “%ProgramFiles64%Wireshark”, and this % ... % maps to “C:Program FilesWireshark” on most systems.

Wireshark on Windows needs npcap for capturing packets. The latest npcap installer is part of the Wireshark installer. If npcap is not installed, live network traffic packet capture won’t be allowed, but Wireshark will still be able to open and analyze saved capture files. By default, the latest version of npcap is installed, but if a different version is required or reinstallation of npcap is needed, it can be done by triggering the install and checking the Install Npcap box as appropriate.

The First Capture

Chapter 2 covers the packet capture approach, dependencies, capture filter, etc. in detail. In this section, we are covering basics to get you started with Wireshark.

Once the Wireshark application is launched, the main interface is shown including sections for basic capture controls, capture filters, and display filters. Select the desired interface from the list by clicking and hit the start capture button to start the capture. To select multiple interfaces, press the Ctrl key (Command on MacOSx) and select the needed interfaces.

A screenshot of the Wireshark network analyzer has a menu bar and toolbar. An arrow mark points to an icon labeled start capture, a filer text bar labeled specify a filter, and select the interface at wifi.

When capture is in progress, by default it shows live the packets being captured in various colors for different packet types. To stop, click the red square “Stop Capturing” button right next to the “Start Capturing” button. At first glance, you’ll notice the data split into various columns.

A screenshot of the Wireshark live capture includes the no, time, sources, destination, protocols, length, and info. Highlights number 72 and 79.

Understanding a Packet

It’s time to investigate a capture at the individual level. This is an example of one of the TCP packets captured.

A screenshot of filters includes the no, time, source, destination, protocol, length, and info. The page highlights 4 lines of frame 12, ethernet IT, internet protocol version, and transmission control protocol.

When a packet is selected, Wireshark opens the bottom panel which gives important information on the features that are conveniently presented in the same way as the OSI model. The number of layers seen changes as the protocol selected changes.

In the preceding example, from the top down we can see the frame layer, the Ethernet (data link) layer, the IP (network) layer, and the TCP (transport) layer.

If there are more layers or headers in the packet, it is sequentially decoded in the Wireshark packet view. For a packet with multiple encapsulated protocols to be decoded properly, there must be a dissector available that decodes the corresponding protocol layer.

Every packet decode starts with the Frame dissector. It dissects the details of the captured metadata itself (e.g., timestamps). The Frame dissector passes the data to the lowest-level data dissector in the data link layer, for example, the Ethernet dissector gets triggered for the Ethernet header. The packet is then passed to the next dissector in the network layer, for example, the IPv4/v6 dissector gets triggered and so on. Each stage of dissectors decodes and displays the details of the packet.

Dissectors can be written as a self-registering plugin (a shared library or DLL) or built into Wireshark source code. The biggest benefit of going with the plugin approach is that rebuilding a plugin is much faster. If the dissector is built into the source code, then Wireshark needs to be completely recompiled and rebuilt. Hence, it makes more sense to write a dissector as a plugin. More details on dissectors are available in Chapter 9.

Capture Filters

We will discuss in detail capture filters in Chapter 2. Only basics have been included here for completeness on the getting started discussion.

Capture filters are used to decrease the size of captures by filtering out only relevant packets matching the condition before they are added to the capture file. Clicking the Capture Options button shows a screen containing a list of interfaces.

To set a filter, either an interface can be double-clicked, or a custom filter can be entered in the text box. The following list shows examples of some simple capture filters:

• host 192.168.2.1: Packets to and from host 192.168.2.1

• src host 192.168.2.1: Packets from host 192.168.2.1

• dst host 192.168.2.1: Packets to host 192.168.2.1

• net 192.168.2.0/24: Packets to and from all host part of network 192.168.2.0/24

• port 8080: Packets to or from TCP or UDP port 8080

A screenshot of the filter displays a popup window of Wireshark capture options. Selected input options that list the interface, traffic, link layer header, snaplan, buffer monitor, and capture filter.

Display Filters

This is one of the main advantages of using Wireshark: its clean, simple style to display filtered packets. Wireshark display filters help filter out the matching packets and limit the number of packets displayed on a live capture or while analyzing a file with captured packets. Display filters are different from capture filters, and the syntax is slightly different and simpler than capture filters.

To apply a display filter, simply add the filter text in the display filter box and hit the enter key or apply button. When the display filter is removed from the filter box, all packets are shown.

A display filter can filter matching on a protocol type or a specific field(s) in the protocol. Also, the filter can use logical comparison operators and parentheses to create complex expressions.

The following is a list of some simple frequently used display filters:

• arp or icmp: Packets of type ARP or ICMP

• ip.addr == 192.168.2.1: Packets to and from ipv4 host 192.168.2.1

• ip.src != 192.168.2.1: Packets not from ipv4 host 192.168.2.1

• ip.dst == 192.168.2.1: Packets to ipv4 host 192.168.2.1

• ip.addr == 192.168.2.0/24: Packets to and from all host part of network 192.168.2.0/24

• tcp.port eq 443 or udp.port == 443: Packets to or from TCP or UDP port 443

Wireshark allows automatic display filter creation based on a packet or protocol fields in the packet. Simply right-click the desired packet of interest or protocol fields inside the packet and apply it as a filter. This method uses the device’s IP address, but the conversation filter below it can use its protocol.

A screenshot of the display filter list the no, time, source, destination, protocol, length, and info. A drop-down option lists apply as a filter, which lists selected.

Also, Wireshark allows adding a custom display filter button for frequently used or complex filters. This can be added by clicking the + button beside the display filter box which launches another text box.

A screenshot highlights the IP address == 10.0.0.1, which lists the no, time, source, destination, protocol, length, and info. At the bottom, a line highlights the transmission control protocol, src port 53175, DST port 5201, seq, and len 0.

Pcap vs. Pcapng

Wireshark also gives capabilities to save captures to a file, supporting both pcap and pcapng formats. The latter is a newer format that supports

• Multiple interfaces: Captured packets from multiple interfaces (e.g., wlan0 and eth0) can all be stored in a single file.

• Tagged metadata: Wireshark tags metadata about what machine captured the data, including the OS type and sniffer application.

• Precise timestamps: Time is now expressed as 64-bit time units, number, in seconds relative to January 1, 1970, UTC, instead of the former microseconds.

• Individual comments: “Annotations” can be saved to individual frames of a capture.

The Capture Options tab gives a few additional settings useful to personalize user experience.

A screenshot displays Wireshark capture options. The output option has a capture to a permanent file, output format, create a new file, use a ring buffer

Data Representation

While capturing, there are packets continuously popping up with different symbols and colors, and it can be overwhelming to make sense of it. One of the neat features is a mini map to the left of each packet. Although they may not be very informative, these symbols are helpful from tracing TCP conversations to tracking HTTP responses. Few example representations are shwon in the below table.

Table 1-1

Data Representation

A symbol represents a square with an inverted L-shape line at the center.	First packet in a conversation.
A part of the selected conversation symbol represents a square with a vertical line slightly leftwards from the center.	Part of the selected conversation.
A not part of the selected conversation symbol represents a square with a vertical dashed line slightly leftwards from the center.	Not part of the selected conversation.
A last packet in a conversation symbol represents a square with an L-shape line at the center.	Last packet in a conversation.
A request symbol represents a square with an arrow pointing to the right and a vertical line from its center bottom.	Request.
A response symbol exhibits a vertical line with a left arrow at the center inside the square.	Response.
A symbol exhibits a vertical line with a tick mark at the center.	The selected packet acknowledges this packet.
A symbol exhibits a vertical line with double tick marks at the center.	The selected packet is a duplicate acknowledgment of this packet.
A symbol exhibits a vertical line with a dot at the center.	The selected packet is related to this packet in some other way, e.g., as part of reassembly.

Time Sequence (Stevens)

This graph shows visually the graph of TCP sequence numbers over time, similar to the graph in Richard Stevens’ TCP/IP Illustrated series of books.

In the following example capture, pauses in a transfer can be noticed by zooming into one section of the graph where there is no packet gain over a duration of time. Then clicking this portion takes the packet screen directly to that packet.

A line graph of sequence number versus time. A line begins at 6930000 in 3.0 and rises to 7400000 in 3.24

Time Sequence (tcptrace)

This graph shows TCP metrics details similar to the ones seen through the tcptrace utility, including acknowledgments, selective acknowledgments, forward segments, reverse window sizes, and zero windows.

The blue lines show the bytes of each packet sent by one device, and the green lines above represent the receive window size. If at any point, the vertical blue line reaches the green one, the maximum bytes allowed at that time is reached and the sender cannot live up to its name.

A line graph of sequence number versus time. A line begins at 8200000 in 3.0, stable up to 3.524, and rises to 8275000 in 3.528.

Throughput

This graph shows the average throughput and goodput for a TCP flow.

A line graph and scatter plots of the sequence number and average throughput versus time. A line begins at 0 in 0.0, rises up to 1090 in 0.02, stable up to 0.3, and rises to 1500 in 0.35.

Round Trip Time

This graph shows the round trip time against the time or sequence number. RTT considered here is the acknowledgment timestamp corresponding to a particular packet segment.

A line graph of round trip time versus time. A curve begins at 0.06 in 0.01, rises at 0.14 in 0.045, then drops to 0.06 in 0.275 time seconds.

Window Scaling

This graph shows the TCP window size and outstanding bytes.

A line graph of window size versus time. 2 curves. Line 1 begins at 0 in 0.00 and is stable up to 0 in 0.325. Line 2 begins at 252000 in 0.0 and is stable up to 252000 in 0.325.

Biggest Picture: Flow Graphs

The previous representation of the TCP flow graph was specific to one protocol or flow, but what if there is a visual way to see the entire capture with all its hosts and conversations? Flow graphs!

It shows a consolidated visual representation of multiple host endpoints and the communication between them. The graph shows the flow direction, ports, flags, sequence number, and many more with nice comments explaining the state of the communication. You can scroll through the graph showing packet relative time and inspect all packets or filter connections by ICMP Flows, ICMPv6 Flows, UIM Flows, and TCP Flows. Also, instead of showing for all packets, you can limit the graph to a subset by applying a display filter.

A screenshot of the flow graph lists the time and comments. Highlights the port numbers as 53599 and 80. Below that, it exhibits a checkbox for the limit to display filter, flow type, address, and 4 buttons, help, reset diagram, export, and close.

CloudShark: The Floating Shark

What if we don’t have Wireshark or any other packet analysis utility locally installed and still we need to analyze a capture file or we want to analyze a capture file in the cloud, what do we do?

The networking company QA Café introduced a paid web-based cloud software named CloudShark. It was built around Wireshark’s cousin TShark, a packet-capturing console utility, and it mimics the style, but not functionality like Wireshark, as it cannot capture packets, but analyze them.

Get Me Started!

There is a sign-in and sign-up option at this web page: www.cloudshark.org/login. This is a paid service, but they offer a free 30-day trial.

A screenshot of the cloud shart S a a s login page has a local upload of files, import URL, and index filters. It includes the user, file name, file size, packets, stages, and bandwidth.

Once logged in, a homepage is shown with a side panel of upload options and a main file panel. The local upload can put pcap or pcapng files to the cloud. If the capture file is available on some FTP or HTTP server, a URL import can be done with HTTP and FTP:

• http://username:password@server/path/file.pcap

Import server user credentials are hidden from any viewers of the file and are only stored in the CloudShark database. If the username or password contains special characters, follow these encoding rules. The search button at the bottom left of the page allows searching for previous uploaded files.

Feature Parity with Wireshark

The main packet panel, the variable bottom panel, and even the display filter text box are all kept the same as Wireshark.

A screenshot of the cloud shark packet analysis includes number, time, source, destination, protocol, length, info, drop-down options, and a graph at the top.

The CloudShark interface displays a mini graph that can specify within which duration the application should display. This helps when the capture is big, and we can alter the timeline to focus on packets or the timeline of our interest.

An illustration of a graph inside a rounded rectangle has a fluctuation trend with a peak at the center.

The analysis tool and graph options shown in the menu are very similar to the ones in Wireshark with a few extra security features. Even annotations can be created for each individual packet, making it easier for collaborators to quickly find issues.

To share the capture file, select the export button and either download the current file with all its revisions or create a new one only including the filtered data (Create New Session).

CloudShark API

CloudShark offers a programmable way of interacting with the capture files through an API that allows users to gain packet data, upload/download documents, and expand their network infrastructure. Each registered user will have an API token that behaves like a typical username and password. You can find your default API token by clicking the Preferences ➤ API token option.

Its default permissions can be changed by clicking the token name and applying preferences. The authentication checkbox is important, since not checking it allows users to use the API without being logged in to CloudShark. The token is passed in as a parameter in a search query, which can be used in a script to get information, to embedding it in an HTML web page. Curl is the command mainly used for executing calls on a command-line interface.

A popup window labeled edit A P I Token includes the token id, enabled check box, and label. It includes token permissions, upload settings, and authentication options.

CloudShark API Interaction with Curl

In this example, we have used CURL to test the API. However, other methods can be used to explore the API. Curl comes default on macOS (use www.confusedbycode.com/curl/ for Windows), and it is used to send data between a client and a URL endpoint or server, thus its name, client URL. With CURL form encoding is automatically done with the -F flag, so either a URL or a direct path can be used.

Here are examples of both uploading and downloading via this method:

• Upload capture file

  • URL and HTTP authentication when the capture file is located on a remote HTTP server

    A link reads c url - F url = h t t p colon front slash front slash path front slash to front slash capture front slash file, h t t p s colon front slash front slash w w w dot cloud shark dot org front slash a p i front slash v 1 front slash a p i - key front slash upload.

  • Upload local file (POST)

    A one-line text with a link reads c url - F file = at sign filename dot cap, h t t p s colon front slash front slash w w w dot cloud shark dot org front slash a p i front slash v 1 front slash a p i - key front slash upload.

  • Upload local file (PUT)

    A one-line code to upload files. The link reads h t t p s colon front slash front slash w w w dot cloud shark dot org front slash a p i front slash v 1 front slash a p i - key front slash upload.

  • More details are available on the upload API in the Cloudshark website.

• Download (-s flag silences the call) capture file

  • Save to a file with a file ID as cid to a local file “example.cap”

A one-line link has a query with output. Query, h t t p colon front slash front slash w w w dot cloud shark dot org front slash a p i front slash v 1 front slash a p i - key front slash download front slash c i d. Output, example dot cap.

More details about API can be found in the Cloudshark website.

Auto Upload to CloudShark (Raspberry Pi, Linux, MacOSx)

Even capture files from a Raspberry Pi, Linux, or MacOSx or a remote machine can be uploaded onto CloudShark using a shell script. The script uses dumpcap, a network capturing tool part of TShark.

• If TShark is not installed (test by executing the tshark command), it can be installed by the following commands on a terminal window:

Raspbian

sudo apt-get update

sudo apt-cache search tshark

sudo apt-get install tshark

Ubuntu

sudo apt-get update

sudo apt-get install tshark

MacOSx

Follow the usual Wireshark install. TShark comes along with it.

The cloudshark_capture.sh script is available at the GitHub repository: https://github.com/cloudshark/cloudshark-capture.

• Either directly download the zip file onto your local machine or use the wget command to download

wget https://github.com/cloudshark/cloudshark-capture/archive/refs/heads/master.zip

unzip master.zip

cd cloudshark-capture-master/

• Edit the cloudshark_capture.sh script and enter the API token. Changing the prompt variable to n will disable further optional confirmations after capture.

nano cloudshark_capture.sh

A screenshot titled G N U nano 5.9 with 4 line codes. 1, prompt = y. 2, cloud shark url = h t t p colon front slash w w w dot cloud shark dot org. Highlighted line 3, a p i token = a p i - token. 4, dumpcap = front slash u s r front slash bin front slash dumpcap.

chmod +x cloudshark_capture.sh

• Run the shell script.

./cloudshark_capture.sh -c <number of packets>

Example output

% ./cloudshark_capture.sh -c 10

Capturing on 'Wi-Fi: en0'

File: /tmp/traffic-2022-06-28-055557.pcapng

Packets captured: 10

Packets received/dropped on interface 'Wi-Fi: en0': 10/19 (pcap:0/dumpcap:0/flushed:19/ps_ifdrop:0) (34.5%)

Send to CloudShark via https://www.cloudshark.org (y|n=default) y

Additional Tags? (optional)

Capture Name? (optional) tshark_auto1

A new CloudShark session has been created at:

https://www.cloudshark.org/captures/5a2a617d87b7,

If you get errors related to dumpcap or python, their corresponding executable path can be corrected in the script manually.