Wireshark

Capture on the interface the flow really crosses; the welcome screen's activity sparklines and dumpcap -D show which interfaces are live. Traffic to 127.0.0.1 is delivered inside the operating system and never reaches the Ethernet adapter, so capture it on the loopback interface.

A Wireshark display filter compares typed fields the dissectors registered: http.response.code >= 500 is a numeric test. A bare field name only tests that the field exists, so tcp.flags.syn alone matches nearly every TCP packet.

Expert Information lists anomalies that dissectors flagged, ranked Chat, Note, Warn, Error from lowest to highest (packet comments sit below Chat) and grouped by kind, such as Sequence or Malformed. It shows where to look; it never diagnoses.

Follow TCP Stream rebuilds one connection's payload as the applications exchanged it, both directions in sequence order with retransmitted bytes shown once, and applies the display filter tcp.stream eq N, which Back removes and Close keeps.

TLS encrypts every record after the handshake, so Wireshark sees only ciphertext. It decrypts only with key material: a key log of session secrets written by the client through SSLKEYLOGFILE, or the server's RSA private key for static-RSA sessions.

Run dumpcap headless with -w and a ring buffer, for example -b filesize:500000 -b files:96: it switches files every 500 MB and deletes the oldest once 96 exist, capping disk use at about 48 GB while the latest traffic stays on disk.

Work top-down in Wireshark 4.6: Protocol Hierarchy for what the file holds, Conversations and Endpoints for who talked, an I/O Graph for when it went wrong, then TCP Stream Graphs and Service Response Time on the one flow.

Wireshark offers the TCP payload to the dissector the tcp.port table maps to that port, then to heuristic dissectors; if none claims it, the bytes fall to Data. Analyze > Decode As maps port 8443 to the right dissector.

File > Export Objects > HTTP lists each HTTP body Wireshark reassembled; Save writes the bytes out for hashing. Bodies inside undecrypted TLS never appear, and bodies with missing segments or an encoding Wireshark cannot decompress come out truncated or absent.

Set SSLKEYLOGFILE before the client starts, reproduce the request while capturing, then point Wireshark's TLS preference (Pre)-Master-Secret log filename, tls.keylog_file, at the file; tshark takes the same setting as -o tls.keylog_file:path.

A dissector tried to read past the data it was given and threw, so Wireshark stopped decoding that protocol. The cause can be the wrong dissector, an unreassembled message, genuinely broken bytes, or a dissector bug.

That is display-filter syntax, and Wireshark's capture filter field accepts only libpcap filter expressions. The capture filter for HTTPS is tcp port 443; tcp.port == 443 belongs in the display filter toolbar or tshark -Y.

Wireshark's dissectors are a huge body of code parsing attacker-shaped input, so the project keeps every privileged call in dumpcap. Grant capture rights to dumpcap only: the wireshark group on Debian-family packages, or setcap cap_net_raw,cap_net_admin=ep on dumpcap, restricted to a group.

An associated Wi-Fi adapter hands the host only data frames for its own network, so promiscuous mode adds little. Monitor mode passes every 802.11 frame it hears, management and control included, with a radiotap pseudo-header of signal, channel and rate.

contains looks for a literal string or byte sequence and is case-sensitive; matches applies a case-insensitive Perl-compatible regular expression. contains is refused on http.response.code because it cannot be used on atomic fields such as numbers; compare the number instead.

Wireshark 4.6 compares each segment with the sequence state it saw: resent bytes are a Retransmission, Fast after two duplicate ACKs, Spurious if already ACKed, Out-Of-Order if new and within the initial RTT. All are guesses from the capture point.

TCP ZeroWindow marks the receiver's packet saying its buffer is full; TCP Window Full marks the sender's segment that reached the edge of the receiver's advertised window. Both point at the receiving side, not the network.

A heuristic dissector recognises its protocol from the payload's first bytes rather than a port. It misses when it is disabled, a registered port is tried first, or its signature was never captured; it misclaims when unrelated bytes happen to fit.

'Allow subdissector to reassemble TCP streams', on by default, lets HTTP or TLS decode a message spanning segments on its last segment; 'Reassemble out-of-order segments', off by default and dependent on it, also buffers early-arriving segments into that message.

tcp.stream numbers each TCP conversation in a file from 0, in order of first appearance. A new SYN reusing the same addresses and ports, with a new initial sequence number or after a FIN or RST, gets a new index.

Only when the session used static-RSA key exchange and its full handshake is in the capture. Wireshark 4.6 picks the key by matching it to the public key in the captured server Certificate; the list's IP address column is unused.

The bracketed counters say where: pcap means the operating system's capture buffer overflowed (raise -B, cut -s, use a faster disk), dumpcap means dumpcap failed to write or queue packets, flushed means packets arriving after stop, and ps_ifdrop counts the interface or driver.

Since Wireshark 3.6, != means all-not-equal: ip.addr != 192.0.2.10 keeps IPv4 packets where neither address is that host, and hides frames with no ip.addr at all. !== (any not equal) and === (all equal) arrived in 4.0.

Ask whether the receiver got the missing bytes. A gap followed by duplicate ACKs and a retransmission is real loss; a gap the receiver simply ACKs past, flagged ACKed unseen segment and never resent, is loss at the capture point only.

Prove the capture holds the whole stream (no missing-bytes marker in Follow TCP Stream, contiguity count 1), then hash the exported object against the server and client copies; the pair that matches places the change before or after the capture point.

Turn on the TLS debug file and read why each session failed. The usual causes: the ClientHello is not in the capture, the key log came from another process or run, the client never read SSLKEYLOGFILE, or the browser used QUIC.

Each Wireshark coloring rule is a name, a display filter and colors; a row takes the colors of the first rule whose filter matches. DNS usually rides on UDP, so a udp rule above a dns rule claims those packets.

pcapng describes each interface separately and can carry comments, name resolution and capture statistics, so one file can hold several interfaces. pcap has one global header with a single link-layer type, so mixed-interface captures cannot be saved as pcap and metadata is dropped.

The in operator tests each tcp.port value against the whole set, ranges included. The spelled-out filter tests >= and <= separately, and a packet from port 56789 to port 80 satisfies each with a different port.