Wireshark Cheat Sheet
Covers Wireshark capture filters, display filters, and common workflows for analyzing network traffic and diagnosing security incidents.
Capture Filters (BPF syntax)
Applied before capture starts to limit which packets are recorded.
host 192.168.1.10 # Traffic to/from a specific hostnet 192.168.1.0/24 # Traffic within a subnetport 443 # Traffic on a specific porttcp port 80 or tcp port 443 # HTTP and HTTPS trafficnot broadcast and not multicast # Exclude noisy broadcast traffic
Display Filters
Applied after capture to narrow down what's shown in the GUI.
ip.addr == 192.168.1.10 # Packets to/from an IPtcp.port == 443 # Packets on a TCP porthttp.request.method == "POST" # HTTP POST requests onlydns.qry.name contains "example" # DNS queries containing a stringtcp.flags.syn == 1 and tcp.flags.ack == 0 # SYN packets (connection attempts)tcp.analysis.retransmission # Show retransmitted packets
Key Analysis Features
Built-in tools for deeper packet and flow analysis.
- Follow TCP Stream- Right-click a packet to reconstruct the full conversation
- Statistics > Protocol Hierarchy- Breakdown of traffic by protocol
- Statistics > Conversations- List of endpoint pairs and traffic volume
- Statistics > IO Graph- Visualize traffic volume over time
- Export Objects- Extract files transferred over HTTP/SMB/etc.
Indicators Worth Investigating
Traffic patterns commonly associated with attacks or malware.
- Many SYN, no SYN-ACK response- Possible port scan or SYN flood
- Repeated DNS queries to odd domains- Possible C2 beaconing or DGA malware
- Unencrypted credentials in HTTP- Plaintext auth over insecure protocol
- Large outbound transfers off-hours- Possible data exfiltration
- ARP replies with mismatched MACs- Possible ARP spoofing / MITM
tshark Field Extraction & Stats at Scale
Pull specific fields into CSV and generate protocol/conversation statistics from the CLI for scripted triage of large captures.
# Extract fields to CSV for downstream analysis (e.g. in a SIEM or spreadsheet)tshark -r capture.pcapng -Y "http.request" -T fields \ -e frame.time -e ip.src -e ip.dst -e http.host -e http.request.uri \ -E header=y -E separator=, -E quote=d > http_requests.csv# Endpoint conversation stats without loading the GUItshark -r capture.pcapng -q -z conv,tcp# Expert info summary (warnings/errors Wireshark flagged automatically)tshark -r capture.pcapng -q -z expert# Reassemble and dump every DNS query/response pairtshark -r capture.pcapng -Y dns -T fields -e dns.qry.name -e dns.a# Read from a live interface, ring-buffer to disk, rotate every 100MB x 10 filesdumpcap -i eth0 -b filesize:100000 -b files:10 -w rotating_capture.pcapng
Decrypting TLS Traffic
Use a logged session-key file to decrypt TLS 1.2/1.3 sessions captured from a browser or curl client you control.
# 1. Have the client log its TLS master secrets (Chrome/Firefox/curl support this)export SSLKEYLOGFILE=$HOME/sslkeys.log# 2. Capture traffic as usualtshark -i eth0 -w capture.pcapng &# 3. Point Wireshark/tshark at the key log to decrypt in-placetshark -r capture.pcapng \ -o "tls.keylog_file:$HOME/sslkeys.log" \ -Y "http2 || http" -T fields -e http.request.full_uri# GUI equivalent: Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename# Note: this only works for traffic where you control the client's key logging —# it does not break TLS you don't have keys for.
Custom Columns & Coloring Rules (Preferences File)
Persist custom display columns and coloring rules by editing the profile config directly, useful for scripting reproducible analyst setups.
# ~/.config/wireshark/colorfilters — add a rule to flag retransmissions in red@[email protected]@[65535,0,0][0,0,0]# ~/.config/wireshark/preferences — add a custom column showing TCP stream indexgui.column.format: "No.","%m", "Time","%t", "Stream","%Cus:tcp.stream", "Source","%s", "Destination","%d", "Protocol","%p", "Length","%L", "Info","%i"# Apply a saved profile from the CLI so scripted captures use the same viewwireshark -r capture.pcapng -C "Incident-Response"
Expert Info Severity Levels
Wireshark's automatic analysis classifies anomalies by severity — triage in this order when short on time.
- Error- Malformed packet or dissector failure; usually indicates capture corruption or a bug, not attacker behavior
- Warning- Protocol-level problems such as checksum errors, out-of-order segments, or window full conditions
- Note- Retransmissions, duplicate ACKs, and other performance-relevant but non-malicious events
- Chat- Informational state changes (e.g. connection FIN/RST) useful for reconstructing session lifecycle
- tcp.analysis.zero_window- Receiver's buffer is full; can indicate resource exhaustion or a DoS symptom worth correlating with host metrics
- tcp.analysis.out_of_order- Packets arriving out of sequence; common on lossy links but also seen with certain injection/MITM tooling
Minimal Lua Post-Dissector
Skeleton for a custom Lua script that tags packets matching a heuristic, loaded via -X lua_script for one-off investigations without writing a full C dissector.
-- save as tag_suspect.lua, run with: tshark -X lua_script:tag_suspect.lua -r capture.pcapnglocal suspect_field = ProtoField.bool("suspect.flag", "Suspect Flag")local suspect_proto = Proto("suspect", "Suspicious Traffic Tagger")suspect_proto.fields = { suspect_field }function suspect_proto.dissector(buffer, pinfo, tree) local dns_name = Field.new("dns.qry.name") local f = dns_name() if f then local name = tostring(f) -- flag unusually long subdomains often seen in DNS tunneling if #name > 50 then pinfo.cols.info:append(" [SUSPECT: long DNS label]") local subtree = tree:add(suspect_proto, buffer()) subtree:add(suspect_field, true) end endendregister_postdissector(suspect_proto)
Use 'tshark' (Wireshark's CLI companion) with the same display filter syntax to script large-scale pcap triage — e.g. tshark -r capture.pcap -Y "http.request" -T fields -e ip.src -e http.host — instead of loading massive files in the GUI.
