Data Packet Capture and Filters in WireShark

Introduction

Data Packet Capture in Wireshark refers to the process of capturing and analyzing network traffic to gain insights into the communication occurring between different devices on a network.

Wireshark is a powerful tool that allows you to capture, dissect, and analyze individual packets exchanged over a network.

Steps for Data Packet Capture Process

Here is a step-by-step overview of the data packet capture process in Wireshark:

1. Launch Wireshark: Open the Wireshark application on your computer.
2. Select Capture Interface: Wireshark presents a list of available network interfaces on your system. Choose the interface through which you want to capture packets, such as a wired Ethernet interface or a wireless adapter.
3. Start Packet Capture: Once you have selected the capture interface, click on the “Start” or “Capture” button to begin capturing packets. Wireshark will start monitoring the selected interface for incoming and outgoing network traffic.
4. Observe Captured Packets: As packets are captured, you will see them displayed in real-time in the packet list pane. Each captured packet is listed as a separate entry, typically showing information such as the source and destination addresses, protocol used, and packet size.
5. Analyze Packet Details: By clicking on a packet in the packet list pane, you can view its detailed analysis in the packet details pane. Wireshark decodes the packet’s contents and displays the individual protocol layers, including headers and payload data. You can expand each layer to inspect the specific fields and their values.
6. Apply Filters: Wireshark provides powerful filtering capabilities to focus on specific packets or types of traffic. You can apply display filters to limit the displayed packets based on criteria like protocol, source or destination IP address, port number, and more. Filters help isolate relevant packets and reduce the amount of data to analyze.
7. Stop Packet Capture: When you have captured sufficient packets or want to stop the capture process, click on the “Stop” or “Capture” button. Wireshark will halt the packet capture and display the final set of captured packets.
8. Analyze and Interpret Captured Data: Once the packet capture is complete, you can analyze the captured data to gain insights into network behavior, troubleshoot issues, or assess security. Wireshark offers a range of features, including protocol statistics, flow analysis, packet coloring, and expert analysis, to aid in understanding the captured traffic.
9. Save Capture Files: If you want to retain the captured packets for future analysis, you can save them to a file. Wireshark allows you to save the entire capture or a selected subset of packets to formats like pcap or pcapng.

Remember, capturing network traffic may require appropriate permissions or administrative privileges. Additionally, when working with sensitive information or in regulated environments, it’s crucial to adhere to privacy and legal considerations while capturing and analyzing packet data.

Wireshark provides a comprehensive set of tools and features for capturing and dissecting network packets, enabling you to gain valuable insights into network communications and troubleshoot network-related issues.

Data Packet Capturing Frames

There are three different parts of the frame available in the Data Capture Framework in WireShark.

A) Top Frame

In Wireshark, the “top frame” refers to the highest-level protocol layer displayed in the packet details pane for a captured packet. It represents the protocol that encapsulates the entire packet and provides an overview of the packet’s structure and purpose.

[Image]

The top frame typically corresponds to the most common protocol used in the captured packet, such as Ethernet, IP (Internet Protocol), TCP (Transmission Control Protocol), UDP (User Datagram Protocol), or HTTP (Hypertext Transfer Protocol). It serves as a starting point for analyzing the packet and understanding its content.

By clicking on the top frame in the packet list pane, you can expand and collapse the details of the encapsulated protocols, allowing you to delve deeper into the packet’s internal layers. Each protocol layer is nested under its parent layer, providing a hierarchical view of the packet’s structure.

The top frame provides essential information about the encapsulating protocol, such as source and destination addresses, protocol version, and key fields specific to that protocol. Additionally, it often includes summary information, such as the length of the packet, timestamp, and any flags or control bits associated with the protocol.

Analyzing the top frame and its associated layers helps in understanding how data is organized, transmitted, and interpreted across the network. It allows you to identify potential issues, diagnose network problems, and gain insights into the behavior of network protocols and applications.

In simple words, it contains the following column in the Top Frame:

Number: Frame number from the beginning of the pcap. The first frame is always 1.

Time: Seconds broken down to the nanosecond from the first frame of the pcap. The first frame is always 0.000000.

Source:  Source address, commonly an IPv4, IPv6, or Ethernet address.

Destination: Destination address, commonly an IPv4, IPv6, or Ethernet address.

Protocol: Protocol used in the Ethernet frame, IP packet, or TCP segment (ARP, DNS, TCP, HTTP, etc.).

Length: Length of the frame in bytes.

Info: Basically it gives all the information about each transaction of packets in a summarized manner.

B) Middle Frame/ Intermediate Layer

In Wireshark, the term “intermediate layer” is not commonly used. However, it can be understood as referring to the protocol layers that are neither the highest level (top frame) nor the lowest level (bottom frame) in the packet details pane.

[Image]

The intermediate layers, which are located between the top and bottom frames, represent the protocols that are responsible for encapsulating and transmitting the packet but are not the highest or lowest level. These intermediate layers vary depending on the specific protocols and encapsulation used in the captured packet.

For instance, if the top frame is an Ethernet layer and the bottom frame is an HTTP layer, the intermediate layers might include the IP layer (Internet Protocol) and the TCP or UDP layer (Transport Control Protocol or User Datagram Protocol) if the packet is carried over a TCP/IP network.

C) Bottom Frame

The bottom frame, or the lowest-level layer, typically corresponds to the protocol layer that carries the actual payload or data. For example, in a network capture involving web traffic, the bottom frame might represent the HTTP layer, which contains the HTTP request or response data.

[Image]

By expanding the bottom frame in the packet details pane, you can examine the specific fields and values within that protocol layer. This allows you to analyze the actual content being transmitted over the network.

It’s important to note that the term “bottom frame” is not an official term used in Wireshark or networking protocols. The more commonly used terms are “highest-level protocol layer” (top frame) and “lowest-level protocol layer,” which represent the encapsulating and payload-carrying layers, respectively, within the packet details pane.

Filters in WireShark

Filters in Wireshark allow you to selectively display or capture specific packets based on defined criteria. They help you focus on relevant network traffic and narrow down your analysis. Wireshark provides two types of filters: display filters and capture filters.

1. Display Filters:
   • Display filters allow you to filter and display packets that meet specific criteria within the captured packet list.
   • They are applied after the packets have been captured and are useful for post-capture analysis.
   • Display filters can be based on various attributes, such as protocol, source or destination IP address, port number, packet length, and more.
   • Examples of display filters:
     • “ip.addr == 192.168.0.1” (display packets with a source or destination IP address of 192.168.0.1)
     • “tcp.port == 80” (display packets with a source or destination port of 80)
2. Capture Filters:
   • Capture filters are applied before capturing packets and allow you to selectively capture only the packets that match specific criteria.
   • They help reduce the amount of captured data, which can be beneficial when capturing packets on high-traffic networks.
   • Capture filters use the Berkeley Packet Filter (BPF) syntax and are specified in the Capture Options dialog or via command-line options.
   • Capture filters can be based on various criteria, including protocol, source or destination IP address, port number, and packet size.
   • Examples of capture filters:
     • “host 192.168.0.1” (capture packets with a source or destination IP address of 192.168.0.1)
     • “port 80” (capture packets with a source or destination port of 80)

Both display filters and capture filters use similar syntax but are applied at different stages of the packet analysis process. Display filters help you focus on specific packets within the captured data, while capture filters control which packets are captured in the first place.

Wireshark provides a wide range of filter options, allowing you to create complex filters by combining multiple criteria using logical operators like AND, OR, and NOT. Filters help you extract the information you need and streamline your analysis process in Wireshark.

FAQ

Recent Articles on Computer Networks

1. Introduction to Computer Networking | What is Computer Network
2. What are Topology & Types of Topology in Computer Network
3. What is FootPrinting in Cyber Security and its Types, Purpose
4. Introduction to Cloud Computing | What is Cloud Computing
5. Distributed Shared Memory and its advantages and Disadvantages
6. What is VPN? How doe VPN Work? What VPN should I use?
7. What is an Internet and How the Internet Works
8. What is a Website and How Does a Website or web work?
9. Introduction to Virus and different types of Viruses in Computer
10. What is TCP and its Types and What is TCP three-way Handshake
11. What is UDP Protocol? How does it work and what are its advantages?
12. What is an IP and its Functions, What is IPv4 and IPv6 Address
13. What is MAC Address and its Types and Difference MAC vs IP
14. What is ARP and its Types? How Does it Work and ARP Format
15. Sessions and Cookies and the Difference Between Them
16. What is ICMP Protocol and its Message Format?

Related Articles on Linux

1. What is Linux Operating System | Introduction to Linux
2. Directory in Linux Define | Linux Directory & its Commands
3. Explain the chmod command in Linux | Linux chmod command
4. Linux User Management || User Management in Linux
5. Linux Computer Network Advanced Command | Network Command
6. Redirection in Linux I/O| Linux I/O Redirection