Wireshark Basics

While tools like SNMP and NetFlow provide aggregated statistics about network performance, they cannot tell you exactly why a specific application connection is failing. To solve deep protocol-level issues, network administrators use a protocol analyzer—the most famous being Wireshark.

What is Wireshark?

Wireshark is a packet capture (PCAP) tool. It captures individual Ethernet frames traversing a network interface, decodes the raw binary data, and visually dissects it into human-readable protocol layers. Wireshark can dissect everything from foundational protocols like Ethernet, IP, TCP, and UDP, to application protocols like DNS and HTTP.

Capture Filters vs Display Filters

In high-speed networks, capturing every single packet will fill a hard drive in seconds. Wireshark uses two types of filters to manage this:

• Capture Filters: Applied before the capture starts. The network card hardware drops uninteresting traffic and only saves matching packets to disk. This is highly efficient but permanently discards other traffic.
• Display Filters: Applied after a capture is taken. You capture everything, save it to disk, and then use display filters to visually hide irrelevant packets on the screen. This allows you to hunt for specific needles in the haystack.

Safe, Practical Display Filter Examples

To analyze traffic effectively, you must learn basic display filter syntax.

Analyzing Legitimate Troubleshooting Scenarios

1. The TCP Handshake Problem

Before any data can transfer over TCP, a 3-way handshake must occur: SYN → SYN-ACK → ACK. If an internal server is complaining it cannot reach an external API, capture the traffic. If you see your server send a SYN packet, but it never receives a SYN-ACK back, you instantly know a firewall is blocking the traffic, or the remote server is down.

2. DNS Lookup Failures

If a user types a URL and gets an error, apply the dns filter. Look at the DNS Response packet. Does it contain a valid IP address, or does it return an error like "No Such Name" (NXDOMAIN)? If it returns NXDOMAIN, the network routing is fine, but the DNS record doesn't exist.

3. Identifying Packet Loss

When investigating Packet Loss or slow application performance, look for Wireshark's built-in expert warnings:

• TCP Retransmission: The sender never received an acknowledgment for a packet, assuming it was dropped in transit, and is sending it again. A high volume of retransmissions indicates a terrible network link.
• Duplicate ACK: The receiver is telling the sender, "I received packet 1, 2, and 4. I am still waiting for packet 3."
• RST (Reset): A server abruptly slamming the connection shut, often due to a crashed application or a firewall intervention.

Packet Capture Best Practices

Because packet captures contain the literal contents of network traffic, they represent a significant security and privacy risk.

• Authorized Use Only: Only capture traffic you are explicitly authorized to analyze for legitimate administrative troubleshooting.
• Narrow the Scope: Use Capture Filters to record only the specific IPs or ports involved in the incident. Do not indiscriminately capture all office traffic.
• Avoid Sensitive Payloads: Where possible, truncate the capture to only save packet headers (e.g., the first 64 bytes), discarding the actual data payloads containing files or emails.
• Protect PCAP Files: PCAP files may contain unencrypted tokens, usernames, or proprietary data. Treat them as highly confidential files. Delete them immediately after the investigation is concluded.