Useful Wireshark Commands

                           

Wireshark is a really useful tool. As a network engineer, I always use it. From analyzing traffic to checking the exact cause of the issue, Wireshark will always be there for you. In this blog, we will see some useful commands that we can use to filter the traffic, which will help you isolate the issue.

What is Wireshark 

Wireshark is a network packet analyzer. A network packet analyzer presents captured packet data in as much detail as possible.

You could think of a network packet analyzer as a measuring device for examining what’s happening inside a network cable, just like an electrician uses a voltmeter for examining what’s happening inside an electric cable (but at a higher level, of course).

In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, that has changed. Wireshark is available for free, is open source, and is one of the best packet analyzers available today. 

Useful Wireshark Command:

To check TCP 3-way handshake:

tcp.flags.syn == 1: to find all the syn packets in the Wireshark.

tcp.flags.syn == 1 && tcp.flags.ack == 1: to find the syn-ack

tcp.flags.ack == 1 && tcp.flags.syn == 0: to find ack packets

Read more about TCP 3-way handshake here.: TCP 3-way handshake.

To check the TCP 4-way handshake

Show Only Connection Termination Packets: tcp.flags.fin == 1

Show FIN and ACK Together: tcp.flags.fin == 1 || tcp.flags.ack == 1

Show Only FIN, ACK, FIN-ACK, ACK: (tcp.flags.fin == 1) || (tcp.flags.ack == 1 && tcp.len == 0)

 Client-Side Close Only: tcp.flags.fin == 1 && ip.src == <client_ip>

 Server-Side Close Only: tcp.flags.fin == 1 && ip.src == <server_ip>

Show Graceful vs Abrupt Close :  tcp.flags.fin == 1 || tcp.flags.reset == 1

 Show Only Pure ACKs  : tcp.flags.ack == 1 && tcp.flags.fin == 0 && tcp.len == 0

Detect CLOSE_WAIT Scenario : tcp.flags.fin == 1 || tcp.flags.push == 1

To find a particular IP address

ip.src == <"ip address">. To check a particular IP address in the source field.

ip.dst ==  <"ip address"> To check IP address in the destination field

ip.addr == <"ip address"> To check IP address in both the Source and destination fields.

I will add more commands here as I will use them in blogs, so stay tuned.