Fundamental Wireshark Concepts and Usage
What is Wireshark and what is its primary purpose?
Answer:
Wireshark is a free and open-source packet analyzer. Its primary purpose is to capture and interactively browse the traffic running on a computer network, allowing users to analyze network protocols, troubleshoot network problems, and debug protocol implementations.
Explain the difference between a capture filter and a display filter in Wireshark.
Answer:
A capture filter (e.g., port 80) is applied before packets are written to the capture file, reducing the amount of data captured. A display filter (e.g., http.request) is applied after packets are captured, allowing you to selectively view packets already in the capture file without discarding them.
How do you start a packet capture in Wireshark?
Answer:
To start a packet capture, you select the network interface(s) you want to monitor from the main screen (e.g., Ethernet, Wi-Fi) and then click the 'Start capturing packets' button (usually a fin icon). You can also apply a capture filter before starting.
What is promiscuous mode, and why is it important for network analysis with Wireshark?
Answer:
Promiscuous mode is a setting for a network interface controller (NIC) that allows it to pass all traffic it sees to the CPU, regardless of whether the traffic is addressed to that NIC. It's crucial for Wireshark to capture all network traffic on a segment, not just traffic destined for the capturing machine.
Name three common display filters you might use to analyze web traffic.
Answer:
Three common display filters for web traffic are http (to see all HTTP traffic), http.request (to see only HTTP requests), and tcp.port == 80 || tcp.port == 443 (to see all unencrypted and encrypted web traffic).
How can you follow a TCP stream in Wireshark, and why would you do this?
Answer:
You can follow a TCP stream by right-clicking on a TCP packet in the packet list pane and selecting 'Follow > TCP Stream'. This reassembles and displays the entire conversation between two endpoints, which is useful for debugging application-layer protocols like HTTP or FTP.
Answer:
The 'Statistics' menu provides various analytical tools to summarize captured data. This includes protocol hierarchy statistics, conversation lists (TCP, UDP, IP), endpoint lists, I/O graphs, and more, helping to quickly identify network patterns, top talkers, or anomalies.
Answer:
To save a captured file, go to 'File > Save' or 'File > Save As...'. The most commonly used file format is pcapng (Packet Capture Next Generation), which is the default and supports more features than the older pcap format.
When troubleshooting a slow network connection, what are some key metrics or indicators you would look for in Wireshark?
Answer:
I would look for high retransmission rates (TCP Retransmission), duplicate ACKs, high round-trip times (RTT), window size issues (TCP ZeroWindow), and excessive packet loss. These indicate network congestion, unreliable links, or application-layer delays.
How can you identify potential security issues or suspicious activity using Wireshark?
Answer:
You can look for unusual protocols, excessive failed login attempts (e.g., SSH, FTP), unencrypted sensitive data (e.g., passwords in HTTP), port scans (many SYN packets to different ports), or connections to known malicious IP addresses. Anomalous traffic patterns are key indicators.
