Skip to content
Search

Wireshark

lastmod 2026-07-28created 2014-03-1847 edits

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communication protocol development, and education. It was originally named Ethereal, but was renamed Wireshark in May 2006 due to trademark issues.

Wireshark is cross-platform, provides its user interface with the GTK+ widget toolkit, and captures packets with pcap. It runs on various Unix-like operating systems including Linux, Mac OS X, BSD, and Solaris, as well as on Microsoft Windows. A terminal-based version without a GUI, TShark, is also provided. Wireshark and the other programs distributed with it, such as TShark, are free software released under the terms of the GNU General Public License.

Categories

ETC

  • PlcGateway#pandas packet log statistics - Statistics from analyzing wireshark logs (though in the end it's text analysis)
  • Subtrace - Wireshark for Docker containers

CLI Tools

  • Wireshark miscellaneous utilities: Mergecap, Editcap, Capinfos
  • capinfos - Computes various statistics of a dump file (e.g., packet count, total data size, duration, bytes/sec)
  • mergecap - Tool that merges multiple pcap/pcapng files into a single dump file
  • dumpcap - Command-line packet capturer
  • editcap - Tool that extracts part of a packet dump file
  • reordercap - Tool that reorders the packets recorded in a pcap/pcapng file by time (timestamp)

Features

Wireshark is very similar to tcpdump, but differs in having a graphical front end plus some extra sorting and filtering options.

Wireshark lets the user put network interfaces that support promiscuous mode into that mode. All traffic, including the interface's configured addresses and broadcast/multicast traffic, then shows up on that interface. However, when capturing with packet interception in promiscuous mode on a network switch port, not all traffic going through the switch necessarily passes through the capturing port. So capturing in promiscuous mode cannot see all traffic on the network. Port mirroring or various network taps can extend the capture to any point on the network. Simple passive taps are highly resistant to malware tampering.

On Linux, BSD, and Mac OS X, thanks to libpcap 1.0.0 and later, Wireshark 1.4 and later can put Wi-Fi adapters into monitor mode.

Display Filter vs Capture Filter

  • A Display Filter captures every packet on the network and filters the view you need, whereas
  • a Capture Filter filters which packets get captured in the first place, so it can drastically reduce the size of captured packets.

Display Filter Expressions

Supported protocols

You can check them here: 

"View" - "Internals" - "Supported Protocols"

Filter example

Frame

frame.time <= "2025-02-28 11:00:00"
To filter by arrTime (Arrival Time), use the frame.time field. The frame.time field holds the time the packet was captured, and you can use it to filter packets within a specific time range.
frame.time contains "Feb 28, 2025"
Filter a specific date only

Data

data.len > 0
Filter packets whose Application Protocol Data is larger than 0
Mainly used to exclude packets that contain only protocol headers
data[4] == 0x11 and data[10] != 0x01
Filter packets with a specific value in a specific region of Data
Filters packets where byte 4 of the Application Protocol's Data is 0x11 and byte 10 is not 0x01 (used to filter only packets with a specific identifier)
data contains 0A:0B:0C:0D
Filter packets whose Data contains a specific byte array
Filters packets whose Application Protocol Data contains the hex value 0A0B0C0D
data contains "\"hello\""
Filter packets whose Data contains a specific string
Filters packets whose Application Protocol Data contains the string "hello" (including the double quotes) (the backslash ('\') acts as an escape character so the double quote ('"') is treated as a literal character)

Ethernet Protocol

eth.addr == 00:12:34:56:78:9A
When either the eth source or destination is that MAC address
eth.src == 00:12:34:56:78:9A
eth source MAC address
eth.dst == 00:12:34:56:78:9A
eth destination MAC address

IP Protocol

ip.addr == 10.1.0.1
Search by source or destination IP address
ip.src == 10.1.0.1
Search by source IP address
ip.dst == 13.107.4.50
Search by destination IP address

TCP/UDP Protocol

tcp.port == 8080
Search by TCP source or destination port number
tcp.srcport == 8080
Search by TCP source port number - usually server (src) -> client (dst) packets
tcp.dstport == 8080
Search by TCP destination port number - usually client (dst) -> server (src) packets
tcp or udp
TCP or UDP protocol
tcp.flags.syn == 1 or tcp.flags.fin == 1 or tcp.flags.reset == 1
TCP connect or disconnect, or server response when the TCP server port is closed

HTTP Protocol

http.host == lng1982.tistory.com
Search by domain

Modbus Protocol

modbus.func_code == 1 && tcp.srcport == 502
Read Coil (Function Code 1) Response packets (server -> client)
modbus.func_code == 1 && tcp.dstport == 502
Read Coil (Function Code 1) Request packets (client -> server)

How to inspect the gRPC protocol

The "Protobuf Search Paths Settings" item mentioned along the way is located here: 

상단 메뉴 > Edit > Preferences > Protocols > ProtoBuf > Protobuf search paths

Add the following paths there:

  1. The paths where your own *.proto files are located, and the paths you pass with the protoc -I option.
  2. The directory containing the standard files provided by Protocol Buffers (e.g. any.proto, struct.proto, etc ..).
    • On Linux, add /usr/include.

WARNING

Note that you must add /usr/include, not /usr/include/google/protobuf. (Keep in mind that the subpath is included when you import.)

Then check the "Load .proto files on startup" option.

Filter examples

  • tcp.port == 50052 && grpc && http2.headers.path contains "/ai.eam.dataops.pointclouddata.PointCloudDataService/Upload"

When you can't add a filter because you don't know the filter syntax (how to find it)

If you want to filter on a specific field value of a specific protocol but don't know the filter syntax for it, you can find it as follows.

  1. Right-click the protocol field in the Packet Details pane
  2. Select Apply as Filter
  3. You can see the syntax for filtering on that field
  4. Selected, Not Selected, etc. can also fill in the filter syntax automatically

Wireshark_-_apply_as_filter_menu.png

Adding a Frame Arrival Time column

Right-click on the column area to open a popup, then click "Column Preferences...".

Wireshark_-_Column_Preferences.png

Wireshark's Column Preferences screen appears. Click the "+" button and pick the entry whose Type is "Absolute date, as YYYY-MM-DD, and time".

Wireshark_-Column_Preferences-_Arrival_Time.png

editcap

editcap is a command-line tool provided by Wireshark that can split a PCAP file into multiple files.

Splitting by hour

To split a PCAP file into one-hour chunks, use the following command. 

editcap -i 3600 input.pcap output.pcap
  • -i 3600 - Splits the file every 3600 seconds (1 hour).
  • input.pcap - Path to the original PCAP file.
  • output.pcap - Name of the files to create. Files are generated automatically as output_00000.pcap, output_00001.pcap, and so on.

Complex methods

For more complex methods, you probably need tshark.

Traffic analysis basics

Server packet analysis

See Tcpdump#Server packet analysis.

Troubleshooting

HTTP shown as IPA

Among captured packets, some often show IPA in the protocol field. You can see them as HTTP packets with the following setting. 

wireshark -> analyze -> enabled protocol -> GSM over IP (disable)

Not running properly right after installation on Ubuntu

A warning dialog like the following may appear.

Wireshark-ubuntu-install-alert.png

As the message says, configure the permissions and add the group. 

$ sudo dpkg-reconfigure wireshark-common
## 질문에 대해 <YES>를 입력하면 된다.

$ sudo usermod -a -G wireshark $USERNAME

See also

Favorite site

References

  1. Meetup_TOAST_Cloud_-_Analyze_my_protocol_with_Wireshark.pdf ↩

author Zer0 sitemap