These statistics have their own Dropbox menu in Wireshark’s menu ribbon. Wireshark also provides a wealth of high-level statistical data regarding a packet capture. Simply by scrolling through the packet summaries, it’s possible to get a rough idea of the mix of traffic in a capture and identify some potential abnormalities that deserve further investigation. For example, RST packets in TCP are colored red, making it easy to see if there is anomalous behavior on the network (in this case, a possible scan). Wireshark also includes visual cues for unusual packets.

The colors in the capture above make it easy to differentiate DNS traffic (blue) from HTTP (green). Each line summarizes a packet, and packets are color-coded based on protocol and other attributes.

The screenshot above shows a sample of Wireshark’s default view. Wireshark is a great tool for achieving high-level awareness of the types of traffic in a packet capture or flowing live over a network.

This section looks at some of the basic capabilities of Wireshark and their applications and potential utility for IR. Since most malware and cyberattacks use the network, the ability to analyze network traffic data is invaluable for incident response.

Wireshark certification