Wireshark

Tool manual · command & filter cheat sheet

Network · Beginner · Network lane

BeginnerNetworkPacket AnalyzerKali

Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is Wireshark?

Wireshark is a free, open-source packet analyzer. It records network traffic (packets) and lets you open, filter, and inspect that traffic in detail — like a microscope for what devices send across a network.

Use it to see real packets: DNS lookups, TCP handshakes, HTTP requests, TLS sessions, ARP, ICMP, and more. That helps you troubleshoot connectivity, verify protocols, and support authorized investigations.

Official website: Wireshark · Documentation

When do you use it?

A website or app fails only on some networks — you need DNS, TCP, or TLS detail.
Confirm which hosts talk to which ports on a lab or authorized network.
You received a .pcap / .pcapng and need to inspect what happened.
Learning networking (TCP/IP, DNS, HTTP) with live packets.
SOC / IR on authorized captures.

When not to use it

Do not capture on networks without written authorization.
Do not expect HTTPS page plaintext — TLS encrypts payloads.
For enterprise-scale continuous logging prefer SIEM/NSM sensors; Wireshark is interactive analysis.
For simple port checks start with ping/curl/nmap.

Who uses it?

Network engineers
SOC / blue team analysts
Students and instructors
Security testers (authorized traffic only)

How do you use it? (typical flow)

Choose an interface or open an existing capture file.
Optionally set a capture filter to reduce noise.
Start capture (or load a pcap). Review the packet list.
Apply display filters (dns, tcp.port == 443, …).
Inspect layers; use Follow → TCP Stream for one conversation.
Use Statistics (Protocol Hierarchy, Conversations, Endpoints).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

1. tshark help
```
tshark -h
```
CLI flag overview — same habit as --help on other tools.
2. tshark version
```
tshark -v
```
Version and libraries.
3. List interfaces
```
tshark -D
```
What you can pass to -i.
4. Man tshark
```
man tshark
```
Full Linux manual page.
5. Man wireshark
```
man wireshark
```
GUI overview on Linux; on Windows use in-app Help.
6. Display Filter Reference
```
Help → Online → Display Filter Reference
```
Official field list (ip.addr, dns.qry.name, …).

7. User guide

https://www.wireshark.org/docs/wsug_html/

Complete official manual.

Kali Linux

Preinstalled on Kali Linux (wireshark / tshark). Non-root capture may require wireshark group membership — follow your lab policy.

1. Installation

OS	Installation
`Kali Linux`	Usually preinstalled. Else: sudo apt install wireshark tshark
`Windows`	Official installer from wireshark.org (includes Npcap).
`macOS`	Official installer from wireshark.org.
`Ubuntu / Debian`	sudo apt install wireshark

2. Basic commands

1. Open GUI
```
wireshark
```
Starts Wireshark graphical analyzer.
2. Open a pcap in GUI
```
wireshark capture.pcap
```
Analyze a saved capture.
3. List interfaces
```
tshark -D
```
tshark = CLI engine.
4. Live capture
```
tshark -i eth0
```
Replace eth0 with your interface.
5. Capture to file
```
tshark -i eth0 -w capture.pcap
```
Save packets for later.
6. Read file (CLI)
```
tshark -r capture.pcap
```
Summary without GUI.
7. Stop after N packets
```
tshark -i eth0 -c 100
```
Quick sample.
8. Display filter while reading
```
tshark -r capture.pcap -Y "dns"
```
-Y = display/read filter.
9. Capture filter
```
tshark -i eth0 -f "port 53" -w dns.pcap
```
-f = BPF capture filter (different syntax).

3. Display filter cheatsheet

Display filters are typed in the Wireshark filter bar (or tshark -Y). They hide/show packets after capture — they are not the same as capture filters.

Filter	Purpose
`dns`	DNS queries/responses
`http`	Cleartext HTTP
`tls`	TLS sessions
`tcp`	TCP
`udp`	UDP
`icmp`	ICMP
`arp`	ARP
`ip.addr == 192.168.1.10`	Packets involving this IP
`ip.src == 192.168.1.10`	From this IP
`ip.dst == 192.168.1.10`	To this IP
`tcp.port == 443`	TCP port 443
`tcp.port == 80`	TCP port 80
`dns \|\| http`	DNS or HTTP
`tcp && ip.addr == 192.168.1.10`	TCP involving this IP
`tcp.flags.syn == 1`	SYN set
`tcp.flags.reset == 1`	RST set
`http.request.method == "GET"`	HTTP GETs
`dns.qry.name contains "example"`	DNS name contains text

4. Capture filter examples

Capture filters decide which packets are collected (tshark -f or Capture Options). Different syntax from display filters.

Capture filter	Purpose
`host 192.168.1.10`	To/from host
`src host 192.168.1.10`	From host
`dst host 192.168.1.10`	To host
`port 53`	DNS port
`tcp port 443`	TCP/443
`udp`	UDP only
`icmp`	ICMP only
`net 192.168.1.0/24`	Subnet
`not port 22`	Exclude SSH noise

5. Useful features

Packet list / detail / bytes panes
Follow TCP/UDP/TLS/HTTP streams
Protocol Hierarchy
Conversations & Endpoints
Export Objects
IO Graphs & Statistics
Coloring rules

6. Practical examples

Example 1: DNS only
```
dns
```
Display filter bar or tshark -Y "dns".
Example 2: One host as source
```
ip.src == 192.168.1.10
```
Authorized host only.
Example 3: TLS
```
tls
```
Handshake/metadata; payload encrypted.
Example 4: TCP/443
```
tcp.port == 443
```
Port activity without decoding content.
Example 5: Read pcap CLI
```
tshark -r capture.pcap
```
Server-friendly.
Example 6: Follow stream (GUI)
```
Right-click → Follow → TCP Stream
```
Rebuild one conversation.

7. Important notes

wireshark = GUI; tshark = CLI.
Display filters ≠ capture filters (different languages).
Kali: may need wireshark group or root for live capture.
Written permission required for networks you do not own.
Stuck on a flag? tshark -h, man tshark, Display Filter Reference.

Related course: networking fundamentals · network security · Commands: /commands#networking