Mastering Wireshark: Essential Filters for Cybersecurity Analysis

By /

Listen to this Post

Featured Image

Introduction

Wireshark is a powerful network protocol analyzer used by cybersecurity professionals, IT administrators, and ethical hackers to inspect network traffic in real time. Mastering Wireshark filters allows for efficient detection of malicious activity, troubleshooting network issues, and analyzing packet-level data. This guide provides a cheat sheet of verified filters and step-by-step instructions to enhance your network forensics skills.

Learning Objectives

  • Learn essential Wireshark display and capture filters for threat detection.
  • Understand how to isolate malicious traffic and analyze suspicious packets.
  • Apply filters for incident response, malware analysis, and network troubleshooting.

1. Basic Display Filters for Traffic Analysis

Filter: `http`

Purpose: Isolates HTTP traffic for web request analysis.

Steps:

  1. Open Wireshark and start a live capture or load a `.pcap` file.
  2. In the display filter bar, type `http` and press Enter.
  3. Analyze HTTP requests/responses for anomalies (e.g., unauthorized access).

Filter: `tcp.port == 443`

Purpose: Filters HTTPS traffic for encrypted communication inspection.

Steps:

  1. Apply `tcp.port == 443` in the filter bar.
  2. Decrypt traffic (if possible) using SSL/TLS keys for deeper analysis.

2. Detecting Malicious Activity

Filter: `dns.qry.name contains “malware.com”`

Purpose: Identifies DNS queries to known malicious domains.

Steps:

  1. Use this filter to detect potential malware C2 (Command & Control) traffic.

2. Correlate findings with threat intelligence feeds.

Filter: `ip.src == 192.168.1.100 && tcp.flags.syn == 1`

Purpose: Detects SYN scans (a common reconnaissance technique).

Steps:

  1. Apply the filter to identify repeated SYN packets from a single IP.
  2. Investigate further for potential port scanning or network probing.

3. Analyzing Phishing & Suspicious Emails

Filter: `smtp || imap || pop3`

Purpose: Captures email-related protocols for phishing analysis.

Steps:

  1. Filter SMTP, IMAP, or POP3 traffic to inspect email headers.

2. Look for suspicious attachments (`smtp contains “filename.exe”`).

Filter: `http.request.uri matches “login|signin”`

Purpose: Finds login pages that may be phishing targets.

Steps:

1. Apply the filter to detect credential-harvesting attempts.

  1. Check for fake login forms or unauthorized redirects.

4. Identifying Network Exploits

Filter: `tcp contains “SELECT FROM users”`

Purpose: Detects SQL injection attempts in network traffic.

Steps:

  1. Use this filter to spot SQLi payloads in HTTP requests.
  2. Block the source IP if malicious intent is confirmed.

Filter: `http.request.method == “POST” && http.file_data contains “