Wireshark packet capture basics in Cybersecurity - Step-by-Step Execution

Concept Flow - Wireshark packet capture basics

Start Wireshark

↓

Select Network Interface

↓

Begin Packet Capture

↓

Packets Appear in List

↓

Analyze Packet Details

↓

Stop Capture

↓

Save or Export Capture Data

This flow shows the basic steps of using Wireshark to capture and analyze network packets.

Execution Sample

Cybersecurity

1. Open Wireshark
2. Choose interface (e.g., Wi-Fi)
3. Click Start Capture
4. Watch packets appear
5. Click Stop Capture
6. Save capture file

This sequence captures live network packets on a chosen interface and saves the data for analysis.

Analysis Table

Step	Action	Result	User View
1	Open Wireshark	Wireshark application opens	Blank capture screen with interface list
2	Select network interface	Interface selected for capture	Interface highlighted, ready to start
3	Start capture	Packets start appearing live	Packet list fills with rows showing packet info
4	Packets captured	Packets show source, destination, protocol	Scrolling list updates with new packets
5	Stop capture	Packet capture stops	No new packets appear, capture paused
6	Save capture	Capture file saved to disk	Save confirmation shown
7	Exit	Wireshark closed	Application window closes

💡 Capture stops when user clicks stop or closes Wireshark

State Tracker

Variable	Start	After Step 3	After Step 4	After Step 5	Final
Captured Packets	0	Many (grows over time)	Many (grows over time)	Fixed number (capture stopped)	Saved to file

Key Insights - 3 Insights

Why do packets only appear after starting the capture?

Packets are collected live from the network interface only after clicking start capture, as shown in execution_table step 3 and 4.

What happens if you select the wrong network interface?

You may see no packets or irrelevant traffic because Wireshark listens only on the chosen interface, as in step 2.

Why should you stop the capture before saving?

Stopping capture freezes the packet list so the saved file contains a complete set, as shown in step 5 and 6.

Visual Quiz - 3 Questions

Look at the execution_table, at which step do packets start appearing in Wireshark?

A Step 3

B Step 5

C Step 2

D Step 6

💡 Hint

Check the 'Result' column for when packets start appearing (Step 3).

According to variable_tracker, what happens to 'Captured Packets' after Step 5?

A It resets to zero

B It stays fixed (capture stopped)

C It continues to grow

D It deletes all packets

💡 Hint

Look at the 'Captured Packets' row after Step 5 in variable_tracker.

If you choose the wrong network interface at Step 2, what is the likely outcome?

A Wireshark crashes

B Packets from all interfaces appear

C No packets or irrelevant packets appear

D Capture starts automatically

💡 Hint

Refer to key_moments about interface selection and execution_table Step 2.

Concept Snapshot

Wireshark basics:
1. Open Wireshark
2. Select network interface
3. Start capture to see live packets
4. Stop capture to pause
5. Save capture file
Packets show source, destination, and protocol info.

Full Transcript

Wireshark packet capture basics involve opening the application, selecting the correct network interface, and starting the capture to collect live network packets. Packets appear in a list showing details like source, destination, and protocol. The capture is stopped manually to freeze the data, which can then be saved for later analysis. Choosing the right interface is important to see relevant traffic. This process helps users analyze network activity step-by-step.

Practice

1. What is the primary purpose of Wireshark in cybersecurity?

easy

A. To capture and analyze network packets in real time

B. To encrypt network traffic for security

C. To block unauthorized network access

D. To create virtual private networks (VPNs)

Solution

1. Step 1: Understand Wireshark's function

   Wireshark is a tool designed to capture and display network packets as they travel through a network.

2. Step 2: Identify the correct purpose

   Among the options, only capturing and analyzing packets matches Wireshark's main use.

3. Final Answer:

   To capture and analyze network packets in real time -> Option A

4. Quick Check:

   Wireshark captures packets = To capture and analyze network packets in real time [OK]

Hint: Wireshark shows network data live, not encrypt or block [OK]

Common Mistakes:

• Confusing Wireshark with firewall or VPN tools
• Thinking Wireshark encrypts data
• Assuming Wireshark blocks traffic

2. Which of the following is the correct way to start a packet capture in Wireshark?

easy

A. Click on 'File' then 'Open Capture'

B. Click on 'Capture' then 'Start'

C. Click on 'Analyze' then 'Filter'

D. Click on 'Edit' then 'Preferences'

Solution

1. Step 1: Identify the menu for starting capture

   In Wireshark, the 'Capture' menu contains options to start or stop capturing packets.

2. Step 2: Match the correct action

   Clicking 'Capture' then 'Start' begins the live packet capture process.

3. Final Answer:

   Click on 'Capture' then 'Start' -> Option B

4. Quick Check:

   Start capture via Capture menu = Click on 'Capture' then 'Start' [OK]

Hint: Start capture under 'Capture' menu, not 'File' or 'Edit' [OK]

Common Mistakes:

• Choosing 'File' to start capture instead of 'Capture'
• Confusing 'Analyze' with starting capture
• Looking in 'Edit' menu for capture options

3. Consider the following Wireshark filter: ip.src == 192.168.1.10. What does this filter do?

medium

A. Shows packets where the destination IP is 192.168.1.10

B. Shows packets with any IP address except 192.168.1.10

C. Shows packets where the source IP is 192.168.1.10

D. Shows packets where either source or destination IP is 192.168.1.10

Solution

1. Step 1: Understand the filter syntax

   The filter ip.src == 192.168.1.10 means packets where the source IP address equals 192.168.1.10.

2. Step 2: Match filter meaning to options

   Only Shows packets where the source IP is 192.168.1.10 correctly describes packets with source IP 192.168.1.10.

3. Final Answer:

   Shows packets where the source IP is 192.168.1.10 -> Option C

4. Quick Check:

   ip.src filter = source IP = Shows packets where the source IP is 192.168.1.10 [OK]

Hint: ip.src means source IP, ip.dst means destination IP [OK]

Common Mistakes:

• Confusing source IP with destination IP
• Assuming filter matches both source and destination
• Thinking filter excludes the IP address

4. You tried to filter packets with tcp.port == 80 but no packets appear. What could be a likely reason?

medium

A. Port 80 is not used for TCP traffic

B. The filter syntax is incorrect

C. Wireshark does not support filtering by port

D. You captured packets on the wrong network interface

Solution

1. Step 1: Check filter syntax correctness

   The filter tcp.port == 80 is valid syntax to filter TCP packets on port 80.

2. Step 2: Consider capture context

   If no packets appear, a common cause is capturing on the wrong network interface where no HTTP traffic (port 80) passes.

3. Final Answer:

   You captured packets on the wrong network interface -> Option D

4. Quick Check:

   Wrong interface capture = no matching packets = You captured packets on the wrong network interface [OK]

Hint: No packets? Check if capturing on correct network interface [OK]

Common Mistakes:

• Assuming filter syntax is wrong without checking
• Believing Wireshark can't filter by port
• Thinking port 80 is not TCP by default

5. You want to capture only HTTP traffic from a specific device with IP 10.0.0.5 using Wireshark. Which filter should you apply?

hard

A. ip.addr == 10.0.0.5 and tcp.port == 80

B. ip.src == 10.0.0.5 or ip.dst == 10.0.0.5 and tcp.port == 80

C. ip.addr == 10.0.0.5 or tcp.port == 80

D. ip.src == 10.0.0.5 and tcp.port == 80

Solution

1. Step 1: Define the filter requirements

   You want packets where the device IP is either source or destination and the traffic is HTTP (TCP port 80).

2. Step 2: Analyze each filter option

   ip.addr == 10.0.0.5 and tcp.port == 80 uses ip.addr == 10.0.0.5 which matches source or destination IP, combined with tcp.port == 80 to filter HTTP traffic. This matches the requirement exactly.

3. Step 3: Identify issues in other options

   ip.src == 10.0.0.5 or ip.dst == 10.0.0.5 and tcp.port == 80 lacks parentheses, so 'or' and 'and' precedence causes incorrect filtering. ip.addr == 10.0.0.5 or tcp.port == 80 matches any packet with IP 10.0.0.5 or any TCP port 80 packet, which is too broad. ip.src == 10.0.0.5 and tcp.port == 80 only matches packets where 10.0.0.5 is source, missing destination packets.

4. Final Answer:

   ip.addr == 10.0.0.5 and tcp.port == 80 -> Option A

5. Quick Check:

   ip.addr covers both ends + tcp.port 80 = ip.addr == 10.0.0.5 and tcp.port == 80 [OK]

Hint: Use ip.addr for both source/destination IPs in filters [OK]

Common Mistakes:

• Not using parentheses causing wrong logic in filters
• Using only ip.src or ip.dst missing half the traffic
• Using 'or' instead of 'and' causing too many packets