Wireshark Cheat Sheet

Capture

• Start capture on interface wireshark -i eth0
• Capture only N packets wireshark -i eth0 -c 100
• Capture with a display filter applied at start wireshark -i eth0 -f "tcp port 443"
• Read and analyze a saved pcap wireshark file.pcapng
• Batch: read a pcap with a filter applied wireshark -r file.pcap -Y "http"

Capture Filters (BPF) — set before capture

• Only TCP traffic tcp
• Only UDP traffic udp
• Only a port tcp port 80
• Only a host host 10.0.0.1
• Host + port host 10.0.0.1 and tcp port 443
• Subnet traffic net 10.0.0.0/24
• All traffic except DNS not port 53

Display Filters — interactively filter packets

• HTTP only http
• HTTPS / TLS tls or ssl
• DNS queries dns
• Specific IP ip.addr == 10.0.0.5
• Specific source/destination ip.src == 10.0.0.5 / ip.dst == 10.0.0.5
• Port filter tcp.port == 8080
• HTTP with keyword http contains "admin"
• Password in clear text http.request or tcp contains "password"
• ARP only arp
• ICMP only icmp
• Combine with and/or/not (http or dns) and not ip.addr == 192.168.1.1

Follow Streams & Decode

• Follow TCP stream: right-click packet → Follow → TCP Stream (or use tcp.stream == N in display filter)
• Follow UDP stream: right-click → Follow UDP Stream
• Decode as HTTP/other protocol: right-click → Decode As
• Export objects (files transferred over HTTP/SMB): File → Export Objects → HTTP

Reconstructing Credentials & Files

• Filter for auth http.request.method == "POST" and http contains "pass"
• Kerberos / AD auth kerberos
• Extract files from SMB smb2
• VOIP/RTP stream analysis rtp

Statistics & T-Shark

• Protocol hierarchy: Statistics → Protocol Hierarchy
• Conversations / Endpoints: Statistics → Conversations / Endpoints
• IO graph: Statistics → IO Graph

TShark (CLI)

• List interfaces tshark -D
• Dump packets with summary tshark -r file.pcap -T fields -e ip.src -e ip.dst -e tcp.port
• Top talkers tshark -r file.pcap -z io,phs
• Live capture filter tshark -i eth0 -Y http