Wireshark Packet Analysis Tutorial for Beginners | Learn Network Traffic Analysis Step by Step

Introduction

When managing servers and networks, you may encounter connectivity issues such as websites failing to load, slow network performance, or an inability to connect to a server. An essential part of identifying the cause of these problems is packet analysis, which involves examining the packets actually traveling across the network.

This article provides a beginner-friendly introduction to Wireshark, a packet analysis tool widely used around the world. Using actual screenshots, it covers everything from capturing packets and understanding the interface to using display filters and examining common protocols such as TCP, HTTP, DNS, and TLS.

Whether you are using Wireshark for the first time or are unsure what to look for when troubleshooting network issues, this article will help you understand the fundamentals of packet analysis.

What Is Wireshark?

Wireshark is an open-source tool that lets you visually inspect network traffic data, or packets. With Wireshark, you can check details such as:

  • The source and destination IP addresses
  • The protocol being used, such as TCP or HTTP
  • Whether a connection starts and ends normally
  • Whether errors or retransmissions have occurred

Because analyzing tcpdump output directly on Linux can be difficult to read, a common workflow is to capture traffic with tcpdump and then analyze the captured data in Wireshark.

Download the installer for your operating system from the following page and install Wireshark.
Wireshark • Go Deep | Download

How to Use Wireshark

Let’s take a look at how to use Wireshark. Open the pcap file you captured.
The following article explains how to create a pcap file with tcpdump on a Linux server, so you may also find it helpful.
https://eeengineer.com/linux-tcpdump-howto-production/

Understanding the Wireshark Interface

When you open a pcap file in Wireshark, a screen like the one below appears.
The interface is divided into three panes: the Packet List, Packet Details, and Packet Bytes panes. In most cases, you identify the cause of a problem by analyzing the Packet List and Packet Details panes.

  • Packet List
    This pane displays the captured packets in chronological order. Start by reviewing this list for anything unusual in the communication flow.
    • Source
    • Destination
    • Protocol (TCP, HTTP, etc.)
    • Summary (Info)

Cases in which raw packet data needs to be analyzed:

  • Protocol analysis
    Example: checking whether the byte structure conforms to the relevant RFC and whether headers and flags are in the correct positions
  • Inspecting application data
    Checking the actual text or data being transmitted
  • Investigating malformed data or garbled text
    Checking character-encoding issues, unexpected characters, or corrupted binary data
  • Security forensics
    Checking for malicious payloads or matches with known attack patterns

Display Filters

Wireshark display filters let you narrow down captured packets so that only the packets you want to inspect are shown. Focusing on traffic that may be related to the problem can significantly improve troubleshooting efficiency.

Enter a filter expression in the box at the top left, then click the arrow button on the right to apply the display filter.

Here are some commonly used basic filters.

Filtering by Protocol

By specifying a protocol, you can limit the displayed traffic to TCP, UDP, HTTP, or another protocol. The following example shows only TCP traffic.

# Filter expression
tcp

Filtering by IP Address

By specifying an IP address, you can limit the display to traffic associated with a particular host. The following example shows only traffic to or from the node with the IP address 192.168.10.110.

# Filter expression
ip.addr == 192.168.10.110

To specify a source IP address, use the following filter:

# Filter expression
ip.src == 192.168.10.110

To specify a destination IP address, use the following filter:

# Filter expression
ip.dst == 192.168.10.110

Filtering by Port Number

By specifying a port number, you can limit the display to traffic using a particular port. The following example shows only traffic on port 443 (HTTPS).

# Filter expression
tcp.port == 443

Combining Multiple Conditions

You can combine multiple conditions. The following example shows only HTTPS traffic associated with IP address 192.168.10.110 and port 443.

# Filter expression
ip.addr == 192.168.10.110 and tcp.port == 443

Extracting a Specific Communication Session

You can isolate and display a specific communication session. Follow these steps:
Right-click a packet belonging to the session you want to inspect > Follow > TCP Stream

As shown below, Wireshark displays only the packets from the selected communication session.

The following article explains how to inspect the complete flow of a TLS session. Take a look if you are interested.
Illustrated Guide to How HTTPS Works and the TLS 1.3 Flow: An In-Depth Look with Wireshark (Packet Capture)

Troubleshooting Examples

Let’s see what deliberately introduced network failures look like in Wireshark.

Failed TCP Three-Way Handshake

In this example, a client attempts to access an HTTPS website but cannot connect because the TCP three-way handshake fails.

Let’s examine each packet.

The client initiates a connection to the website by sending a [SYN] packet.

The website returns a [SYN, ACK] packet to the client, but the client is then unable to send an [ACK] packet back to the website.

Retransmission is subsequently attempted, as indicated by [TCP Retransmission], but the three-way handshake still cannot be completed.
In this case, the client side is the likely source of the problem. Investigate possible causes such as the client’s firewall filter settings or insufficient client resources.

Failed TLS Handshake

In this example, a client attempts to access an HTTPS website but cannot connect because the TLS handshake fails.

Let’s examine each packet.

We can confirm that the TCP three-way handshake completed successfully.

The following alert appears:
Alert (Level: Fatal, Description: Protocol Version)

This alert means that the TLS handshake began, but the server received traffic using an unsupported TLS version and immediately rejected the connection.

In general, when the TCP connection is established but a TLS Alert is returned, the cause is often a mismatch in the TLS version or cipher suite rather than a firewall issue.

After the alert is received, TCP-layer cleanup occurs and an RST packet is ultimately returned.

Reference: How to Reproduce the Failures Deliberately

For reference, this section explains how to deliberately reproduce these network issues.

How to Reproduce a Failed TCP Three-Way Handshake

On the source server, configure a rule that rejects ACK packets returned by the destination server.

[root@appserver-dev ~]# iptables -A INPUT -p tcp --sport 443 --tcp-flags ACK ACK -j DROP
[root@appserver-dev ~]#
[root@appserver-dev ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             anywhere             tcp spt:https flags:ACK/ACK

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@appserver-dev ~]#

<iptables command options>
-p tcp: TCP traffic only
–sport 443: Source port
–tcp-flags ACK ACK: TCP packets with the ACK flag set
-j DROP: Silently discard packets without returning anything to the sender

Use the following tcpdump command to capture the traffic. While the command is running, try to access the destination website. The ACK packet should be rejected, preventing access to the site. Once the packet capture is complete, press Ctrl+C to stop the command and retrieve the generated pcap file.

[root@appserver-dev ~]# tcpdump -i enp0s3 -nn -s 0 -w handshake_fail.pcap
dropped privs to tcpdump
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C25 packets captured
25 packets received by filter
0 packets dropped by kernel
[root@appserver-dev ~]#

How to Reproduce a Failed TLS Handshake

Add a setting to Apache on the destination server that disables TLS 1.1.

[root@quiz ~]# vi /etc/httpd/conf.d/ssl.conf
[root@quiz ~]# grep SSLProtocol /etc/httpd/conf.d/ssl.conf
#SSLProtocol all -SSLv3
SSLProtocol all -TLSv1.1
[root@quiz ~]# systemctl restart httpd
[root@quiz ~]#

After changing the Apache configuration, an attempt by the client to access the destination server using the disabled TLS version is rejected, as shown below.

[root@appserver-dev ~]# curl --tlsv1.0 --tls-max 1.0 https://eeengineer.com
curl: (35) error:0A0000BF:SSL routines::no protocols available
[root@appserver-dev ~]#

Conclusion

This article covered the fundamentals of packet analysis with Wireshark, including how to read the interface, use display filters, and recognize common network problems.

You do not need to understand every detail of every packet. Start by checking:

  • Whether the TCP three-way handshake completes successfully
  • Whether retransmissions or RST packets occur
  • Whether a TLS Alert appears even though the TCP connection is established

Checking these points alone is often enough to narrow down the cause of a problem.

Wireshark is a powerful tool that makes it possible to see at which network layer a communication problem is occurring.
Start by following the TCP and TLS flows, and build your familiarity by examining actual packets.

スポンサーリンク

コメント