Analyze Network Traffic with Wireshark

This skill covers comprehensive network traffic analysis with Wireshark for security investigations, performance troubleshooting, and protocol learning. It spans capturing traffic (capture filters to limit collection by host/port/network before capture even starts) and a deep library of display filters applied after capture: IP/port filters, protocol filters (HTTP, DNS, SMB, SSH, ICMP, ARP, DHCP), TCP flag filters for identifying connection states (SYN, ACK, FIN, RST), content-search filters (frame contains "password"), analysis filters flagging retransmissions/duplicate ACKs/zero-window conditions, and logical combination of filters with AND/OR/NOT operators.

It covers stream reconstruction (Follow > TCP/UDP/HTTP/TLS Stream to view a full conversation in ASCII/Hex/Raw, useful for spotting plaintext credentials or transferred files) and statistical analysis (Protocol Hierarchy for traffic composition, Conversations and Endpoints for communication pairs and participants, Flow Graph for packet sequence visualization, I/O Graphs for traffic-over-time plotting). Its security-analysis section documents concrete detection patterns: port scan detection (many destination ports from one source with SYN flags), suspicious-traffic filters (unusual ports, traffic outside a trusted network range, large transfers), ARP spoofing detection (duplicate ARP responses, multiple MACs claiming the same IP), malware C2 beaconing indicators (regular timing intervals, encoded payloads, unusual ports, DNS queries with random-looking domain names), and DNS analysis for failed lookups or queries to specific domains. Expert Information (Analyze > Expert Information) surfaces Wireshark's own automated findings categorized as Errors/Warnings/Notes/Chats, mapped to concrete meanings and next actions - e.g. a TCP retransmission means checking for packet loss.

Use this skill for network troubleshooting and connectivity diagnosis, authorized security incident investigation, malware traffic analysis, performance monitoring, or protocol education - working from either a live capture (requiring admin/root privileges) or an offline PCAP/PCAPNG file.

Its constraints are explicit: capture only authorized network traffic, handle captured data per applicable privacy policies, avoid capturing sensitive credentials unnecessarily, and secure PCAP files that do contain sensitive data. It also has hard technical limits worth knowing before relying on it: encrypted traffic content isn't visible without decryption keys, high-speed networks can drop packets during capture, and some protocols need additional dissector plugins for full decoding.

Input is a live network interface or an existing PCAP/PCAPNG capture file to analyze. Output is filtered packet views, reconstructed conversation streams, traffic statistics and visualizations (protocol hierarchy, conversations, flow/IO graphs), and documented findings - e.g. a confirmed cleartext-credential exposure, an identified C2 beaconing pattern, or TCP retransmissions pointing to network congestion - following worked examples for credential analysis, malware C2 detection, and slow-application troubleshooting.

tcp.analysis.retransmission

Built entirely on Wireshark itself (Windows/macOS/Linux), covering its capture engine, display filter language, Follow Stream feature, Statistics menu (Protocol Hierarchy, Conversations, Endpoints, Flow Graph, I/O Graph), Expert Information system, and Export Objects for extracting transferred files such as HTTP downloads.

Network engineers, security analysts, or incident responders doing authorized packet-level investigation - troubleshooting connectivity/performance issues or investigating security incidents - who need concrete filter syntax and analysis workflows rather than a generic Wireshark UI tour.