Network Traffic Analysis with Wireshark
Analyze and monitor network traffic using Wireshark.
Project objective
Build a practical Wireshark workflow: capture live traffic on a lab segment, learn the display filters that actually matter day-to-day, and use a known baseline capture to make an anomalous one (a port scan) obvious rather than something that has to be eyeballed packet-by-packet.
Core work
Traffic was captured on the lab bridge interface, then inspected both in the Wireshark GUI and via tshark for repeatable, scriptable analysis.
# Capture traffic on the lab interface to a file for later analysis
sudo tcpdump -i eth0 -w baseline-capture.pcap
# Generate comparison traffic: a SYN scan against the same lab host
nmap -sS -T4 -p- 10.10.10.5
# Capture the scan traffic separately
sudo tcpdump -i eth0 -w scan-capture.pcap host 10.10.10.5
# Core display filters used during manual inspection in Wireshark:
tcp.flags.syn==1 && tcp.flags.ack==0 # isolate SYN attempts (scan signature)
tcp.analysis.retransmission # find retransmissions / possible packet loss
http.request.method=="POST" # find form submissions / credentials in cleartext
dns.qry.name contains "evil" # hunt suspicious DNS lookups
ip.addr==10.10.10.5 && tcp.port==22 # focus on one host/service conversation
# Command-line equivalent: extract HTTP objects without opening the GUI
tshark -r baseline-capture.pcap --export-objects http,extracted/
# Quick protocol breakdown from the command line
tshark -r scan-capture.pcap -q -z io,phsThe SYN-scan capture showed the expected fingerprint immediately once filtered: hundreds of SYN packets to sequential destination ports from a single source with no completed three-way handshake, versus the baseline capture's ordinary mix of established TCP sessions, DNS lookups, and TLS handshakes.
Protocol distribution by packet count for the baseline capture (tshark -z io,phs) — the scan capture, shown separately in the write-up, is almost entirely bare SYN/RST TCP packets.
What to document
Both captures are referenced with their exact filter strings, a side-by-side packet-count comparison, and a short explanation per filter of what pattern it's designed to surface — so the write-up teaches the filter, not just the one-off result.