Wireshark for Packet Analysis: Catching Attacks on the Wire

Wireshark is the open-source packet analysis tool security teams use to capture and inspect network traffic frame by frame, revealing plaintext credentials, port scans, ARP spoofing, DNS tunnelling, and data exfiltration that firewall logs alone never show. For Indian blue teams, learning to read a capture is the difference between guessing what happened during an incident and proving it. This guide covers capturing traffic, display filters, following TCP and HTTP streams, spotting credential leakage, detecting scan and spoofing patterns, and extracting indicators of compromise (IOCs) — all strictly against networks and systems you own or are explicitly authorised to monitor.

Why Packet Analysis Still Matters for Blue Teams

Endpoint logs and SIEM alerts tell you what a system reported. The packet capture tells you what actually crossed the wire — unfiltered, unaggregated, and impossible for a compromised host to lie about. When a SIEM alert fires on unusual outbound traffic, a raw capture is often the only way to confirm whether it's a false positive, a misconfigured service, or genuine exfiltration in progress.

Capturing Traffic: Interfaces, Promiscuous Mode, and Scope

Before opening Wireshark, define what you're capturing and why. Wireshark can listen on any interface — wired, wireless, or a virtual interface on a hypervisor — and in promiscuous mode it captures every frame the network card sees, not just traffic addressed to your own machine.

tshark -i eth0 -w incident-capture.pcapng

On a switched network, promiscuous mode alone won't show you other hosts' traffic — switches only forward frames to the intended port. To see broader traffic for legitimate monitoring, you need a SPAN/mirror port configured on the switch, or a network TAP, both of which require explicit authorisation from whoever owns that infrastructure.

1. Capture filters (set before capture starts) reduce volume at the NIC level — e.g. host 10.0.0.5 or port 443.
2. Ring buffers (-b filesize:100000 -b files:10) rotate capture files so long-running monitoring doesn't fill disk.
3. Snap length (-s 0 for full packet) matters when you need full payload for credential or exfil analysis, not just headers.

Display Filters: Narrowing the Noise

Once you have a capture — live or a saved .pcap/.pcapng file — display filters are how you actually find anything. Unlike capture filters, display filters don't discard data; they just hide it from view, so you can always widen the filter without recapturing.

http.request.method == "POST" && ip.addr == 10.0.0.5

Some of the most-used filters for blue-team work:

Following TCP and HTTP Streams

A single packet rarely tells the full story. Right-click any packet and choose "Follow → TCP Stream" (or HTTP Stream) to reassemble an entire conversation — request and response, in order, exactly as the two hosts exchanged it. This is where packet analysis moves from theoretical to actionable: you see the actual login form submission, the actual file transfer, the actual command sent to a compromised host.

tcp.stream eq 14

Once you know a stream number from following a conversation, this filter isolates every packet in that exact session, which is invaluable when writing up incident timelines or extracting evidence for a report.

Spotting Plaintext Credentials on the Wire

Legacy and misconfigured services still transmit credentials in cleartext far more often than most SMB teams assume — a symptom, not the root cause, but a critical one to catch during an audit or incident review.

http.request.method == "POST" && http contains "password"

Common protocols worth checking specifically because they historically send credentials unencrypted: HTTP Basic Auth, FTP, Telnet, and older SNMP community strings. Following the TCP stream on any of these usually surfaces the username and password in plain view within the reassembled payload — proof positive that the service needs to move to an encrypted equivalent (HTTPS, SFTP/FTPS, SSH).

Detecting Scans, ARP Spoofing, and DNS Tunnelling

Reconnaissance and lateral-movement activity leave distinctive packet-level signatures once you know what to look for.

1. Port scans show up as a burst of SYN packets from one source IP hitting many destination ports in a short window, frequently with no completed handshake — filter tcp.flags.syn==1 && tcp.flags.ack==0 and sort by source/time to spot the pattern.
2. ARP spoofing appears as duplicate or conflicting ARP replies claiming the same IP maps to different MAC addresses — filter arp.duplicate-address-detected or manually watch for a gateway IP suddenly resolving to an unexpected MAC.
3. DNS tunnelling shows up as an abnormal volume of DNS queries to a single domain, unusually long subdomain labels, or TXT/NULL record queries carrying encoded data — filter dns && frame.len > 100 as a starting heuristic, then inspect query names manually.
4. Data exfiltration over allowed ports often appears as sustained, large, one-directional outbound transfer to an unfamiliar destination — visible in Wireshark's Statistics → Conversations view sorted by bytes sent.

Statistics Tools: Conversations, Protocol Hierarchy, and IO Graphs

Wireshark's Statistics menu turns a packet-by-packet slog into pattern recognition at a glance:

1. Conversations — ranks host pairs by bytes and packets exchanged, the fastest way to spot an unusually large or unusual-destination transfer.
2. Protocol Hierarchy — breaks down the capture by protocol stack, useful for confirming whether unexpected protocols (e.g. IRC, unknown custom TCP) are present on a segment that shouldn't have them.
3. IO Graph — plots traffic volume over time, making traffic spikes (a scan burst, a large exfil transfer) visually obvious even across a long capture.

Extracting IOCs from a Capture

Once an anomaly is confirmed, the capture becomes an evidence source for indicators of compromise that feed into blocklists, SIEM rules, and incident reports: source and destination IPs, suspicious domain names from DNS queries, unusual User-Agent strings from HTTP headers, file hashes of any binaries transferred (extractable via File → Export Objects → HTTP), and JA3/TLS fingerprints for encrypted C2 traffic that can't be inspected directly.

tshark -r incident-capture.pcapng -Y "dns" -T fields -e dns.qry.name | sort -u

A command like this pulls every unique DNS query name from a capture in seconds — turning hours of manual review into a list you can immediately cross-reference against threat intelligence feeds.

CERT-In also publishes regular technical advisories on network traffic monitoring and incident response practices that Indian organisations can align their packet-analysis workflows against. Independent of exact figures, the pattern is consistent across breach research: the organisations that detect incidents fastest are the ones with traffic visibility already in place before the incident starts, not scrambling to capture packets after the fact.

Building a Repeatable Packet-Analysis Workflow

Where Manual Packet Analysis Hits Its Limits

Manual Wireshark analysis is precise but doesn't scale — a security analyst can meaningfully review a handful of incidents a week, not continuously monitor every segment of a growing network in real time. It's also inherently reactive unless paired with automated alerting that tells the analyst where to point Wireshark in the first place.

This is exactly the gap continuous, automated VAPT is built to close. Bachao.AI combines automated vulnerability scanning with the kind of exposure visibility that reduces how often teams need forensic packet analysis in the first place — catching exposed services, weak configurations, and cleartext protocols before they become an incident that needs a pcap to explain. Dhisattva AI Pvt Ltd built the platform around a simple observation: most Indian SMBs have neither the headcount nor the time for full-time packet-level monitoring, so the highest-leverage move is closing exposures upstream, then keeping Wireshark-grade analysis in reserve for when it's actually needed.

Getting Started Safely

Set up a home lab or an isolated test segment before working on production traffic. Capture a known-good baseline first, so anomalies actually stand out against something real. And always keep the authorisation question first: who owns this network, and do you have their explicit, written permission to capture on it.

Want visibility into your exposure before an attacker forces you to find out via a packet capture? Get a free VAPT scan, or browse the Bachao.AI blog for more hands-on security guides. If your organisation processes personal data, also review our DPDP compliance guide for how captured traffic and stored evidence fit into your compliance obligations.