Packet Capture and Wireshark Fundamentals
The network analyst's microscope.
Key takeaways
- Wireshark captures and dissects packets at every OSI layer.
- Display filters isolate specific traffic (e.g., "http", "dns", "ip.addr == 10.1.1.1").
- Protocol dissectors decode application-layer content.
- For SOC analysts, PCAP is the ground truth for incident investigation.
Wireshark is to network analysts what a stethoscope is to a doctor. It lets you see the actual bytes on the wire, decoded into human-readable protocol fields.
Knowledge check
In Wireshark, what does "Follow TCP Stream" show you?