24. Traffic Sniffing and Analysis
24.3 Wireshark: Reading Traffic in a GUI
In short: Wireshark is the standard graphical packet analyser.
Wireshark is the standard graphical packet analyser. Start it, pick an interface, and watch packets arrive; or open a .pcap from tcpdump.
wireshark # GUI (ships with Kali)
# to capture without root in the GUI, add your user to the wireshark group once:
sudo usermod -aG wireshark $USER # then log out and back in
The window has three parts: the packet list (one row per packet), the packet details (protocol layers you can expand – Ethernet, IP, TCP, HTTP), and the packet bytes (raw hex). Colours group protocols; the columns show source, destination, protocol and info.
Ravindra Bagale's Tip
When they open Wireshark and see thousands of packets, students panic. Don't worry – nobody reads every packet. Apply a filter (next section) and look only at what you need. Learning Wireshark means learning filters.
Ravindra Bagale's Tip – मराठी
Wireshark उघडल्यावर हजारो packets बघून students घाबरतात. घाबरू नका – कोणीही सगळे packets वाचत नाही. Filter लावा (पुढचा section) आणि फक्त हवे तेच बघा. Wireshark शिकणे म्हणजे filters शिकणे.
Ravindra Bagale's Tip – हिंदी
Wireshark खोलने पर हज़ारों packets देखकर students घबरा जाते हैं. घबराओ मत – कोई भी सारे packets नहीं पढ़ता. Filter लगाओ (अगला section) और सिर्फ़ जो चाहिए वही देखो. Wireshark सीखना मतलब filters सीखना.
Lab
Open web.pcap from 24.2 in Wireshark. Expand one HTTP packet and identify the four layers (Ethernet, IP, TCP, HTTP). Note the source and destination IP and the TCP ports.