Wisconsin Cyber Response Team
Team Annual Training Conference
October 25-26, 2025
David Zampino

• Learn about Wireshark and some of its many uses
• Describe install options and customize Wireshark for our needs and preferences
• Learn about packet captures (pcaps), utilize different methods of capturing traffic, and identify ideal tap locations
• Filter traffic using capture and display filters
• Identify the structure of packet headers and relevant fields
• Hands-on analysis of malicious traffic

• Project started in 1998
• Originally named Ethereal
• De-facto standard network protocol analyzer
• Free and open source
• Licensed under GPL v2 or later
• Runs on Windows, Linux, macOS, BSD, and more
• https://www.wireshark.org/

• Troubleshoot networks
• Detect intrusions
• Generate statistics
• Reverse engineer proprietary protocols
• Identify malicious traffic
• Carve files

• Tshark
• Capinfos
• Dumpcap
• Editcap
• Mergecap
• Text2pcap

• Refers to both packet captures and a specific file format
• IETF draft of successor: PCAP Next Generation (pcapng)
• File signature
  • D4 C3 B2 A1 (little-endian) = Ôò¡
  • A1 B2 C3 D4 (big-endian) = ¡²ÃÔ
  • 4D 3C B2 A1/A1 B2 3C 4D = nanosecond-resolution
  • 0A 0D 0D 0A = LFCRCRLF = pcapng
• Snapshot length
• TZ always* = 0 = UTC

• tcpdump
• libpcap
• WinPcap
• Win10Pcap
• Npcap

• Plugin interface that allows external binaries to act as capture interfaces
• Etwdump
• Androiddump
• Randpktdump
• Sshdump, Ciscodump, and Wifidump
• UDPdump

• Native options
  • netsh trace
    • Windows 7/Server 2008 R2 – Current
  • pktmon
    • Windows 10 v1809/Server 2019 – Current
• With a Wireshark install
  • WinPcap
    • Windows NT 4.0 – Windows 10*
  • Npcap (Wireshark 3.0.0+)
    • Windows 7 - Current

• netsh trace start capture=yes [persistent=]yes|no [traceFile=]path\filename.etl [maxSize=]filemaxsize [fileMode=]single|circular|append [overwrite=]yes|no [capturefilters]
• netsh trace stop
• netsh trace show capturefilterhelp
• Capture filters:
  • Ethernet.Address=<Mac address>
  • Ethernet.Type=IPv4
  • Protocol=(TCP,UPD)
  • Pv4.Address=<IPv4 address>
  • Supports multiple with ()
  • Support negation with NOT or ! i.e. Ethernet.Type=NOT(IPv6)

• Requires administrative rights
• Can persist through a reboot
• Only generates .etl files
  • Can be converted with etl2pcapng
  • https://github.com/microsoft/etl2pcapng
• No loopback traffic

• pktmon filter add <filters>
• pktmon filter add help
• Capture filters:
  • -m <MAC address>
  • -v <VLAN>
  • -d <data link protocol { IPv4 | IPv6 | ARP | ## }
  • -t <transport layer protocol { TCP | UDP |ICMP | ICMPv6 | ## }
  • -i <IP address>
  • -p <port>
• pktmon start --capture [--pkt-size <bytes>] [--file-name <name>] [--file-size <size>] [--log-mode <mode>]
• Defaults:
  • Packet size of 128 bytes
  • File name of PktMon.etl
  • File size of 512 MB
  • Log mode is circular

• Requires administrative rights
• Actively under development; focus on virtualized networking
• Generates ETL file but can convert its file to pcapng
  • pktmon etl2pcap <file.etl> --out <file.pcapng>
• No option to persist through a reboot
• No option to negate filters
• No loopback traffic
• Syntax has changed

• Ability to select multiple providers
• Ability to filter by keywords
• Ability to filter by logging level

• Developed by Nmap Project
• Proprietary with usage/redistribution restrictions
  • No silent install without license
• Can be installed during Wireshark install
• Option to restrict to Administrators
• Supports raw 802.11 frames in monitor mode and supported adapters
• Loopback traffic

• Does it support libpcap?
• tcpdump
• tcpdump -w <file> -i <interface> -n <no DNS> -s <snapshot length> -C <max file size MB> -W <max number of files> <BPF>
• Example:
  • sudo tcpdump -n -s 0 -i eth0 -w file.pcap <BPF>

• Network device based packet capture, like Cisco EPC
• Port mirroring/SPAN
• Hub
• Network tap

• Location, location, location
• Unicast, broadcast, or multicast
• What spot do I need to be in to see the traffic I’m looking for?
• Is the traffic in transit or terminated?
• What hardware is at my disposal?
• What software is at my disposal?
• Can I install software?
• Be aware of dropped packets and storage requirements
• Promiscuous/monitor mode

• https://www.wireshark.org/download.html
• Windows x64 and Arm64
• Portable edition
• macOS
• Linux
• Source

• Wireshark
• Tshark
• Etwdump
• Npcap
  • Not default:
    • Restrict Npcap driver’s access to Administrators only
    • Support raw 802.11 (and monitor mode) for wireless adapters

• Columns
  • Time
  • Custom
• Layout
• Name resolution
• Geolocation
• Profiles

• Let’s start capturing
• Capture options
• Packet list
• Details
• Bytes view
• Minimap
• Time format
• Packet colorization
• Stopping a capture
• Closing a capture and not Wireshark

• Capture filters = tcpdump = Berkeley (BSD) Packet Filter (BPF)
  • Defines what gets captured
  • Fast and efficient
  • Limited
• Display filters
  • Filters the captured packets
  • Used for colorization rules
  • Used to create smaller PCAPs
  • Much more in-depth syntax
    • 3000+ protocols and 328,000+ fields

• Type qualifiers:
  • host (assumed), ether host, net, port, portrange
• Proto(col) qualifiers
  • arp, ether, ip, ip6, tcp, udp, icmp
• Dir(ection) qualifiers
  • src, dst
• Logic
  • and, or, not, ()
• https://web.archive.org/web/20240227014632/https://packetlife.net/media/library/12/tcpdump.pdf

• <protocol>[.<field name>][.<fieldname>]…
• Comparisons
  • ==, ===, <, >, <=, >=, !=, !==
  • eq/any_eq, all_eq, lt, gt, le, ge, ne/all_ne, any_ne
• Sets
  • in { x y z }
• Logic
  • &&, ||, !()
  • and, or, not ()
• Substring matching
  • contains, matches
  • Case-sensitive; use lower()
• ! gotcha aka. implicit ‘any’ and ‘all’
  • ip.addr!=10.43.54.65 is the same as ip.src!=10.43.54.65 or ip.dst!=10.43.54.65
  • Use !(ip.addr==10.43.54.6) instead
• https://www.wireshark.org/docs/dfref/

• Capture filters in action
• Display filters in action
• Statistics
  • Resolved addresses
  • Protocol hierarchy
  • Conversations
  • Endpoints
• Follow stream
• Decode As
• Export Object

• Create new
• Import
• Export
• Switch to

• Play around
• Practice
• Learn or validate what you know about network protocols
• Generate and capture malicious traffic
• Analyze captured malicious traffic

• https://wiki.wireshark.org/
• https://npcap.com/guide/index.html
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382(v=ws.11)
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/pktmon
• https://web.archive.org/web/20231001020126/https://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf
• https://web.archive.org/web/20231121214153/https://packetlife.net/media/library/12/tcpdump.pdf

• https://wiki.wireshark.org/SampleCaptures
• https://malware-traffic-analysis.net/
• https://www.netresec.com/?page=PcapFiles