Wireshark
Network SecurityForensicsSee the individual packets crossing a network.
Who uses it?
Network engineers, SOC analysts, incident responders and students.
Best for
Deep packet inspection and troubleshooting
Similar tools
Zeek, Nmap
What is it?
Wireshark is a free packet analyser that captures and displays network traffic in detail.
What problem does it solve?
When something behaves strangely on a network, you need to see what was actually sent and received.
How does it work?
It captures packets from a network interface or opens a saved capture file. Protocols are decoded so each packet's fields can be read. Filters narrow the view to the conversation you care about.
Simple example
dns.qry.name contains "example"A display filter that shows DNS queries for names containing “example”.
When would a SOC analyst use it?
When alert data is not enough and the analyst needs to confirm what a suspicious connection really contained.
How does it work?
- 1It captures packets from a network interface or opens a saved capture file.
- 2Protocols are decoded so each packet's fields can be read.
- 3Filters narrow the view to the conversation you care about.
Simple example
Filter a capture for DNS traffic to see which names a machine asked for and what it was told.
dns.qry.name contains "example"A display filter that shows DNS queries for names containing “example”.
When would a SOC analyst use it?
When alert data is not enough and the analyst needs to confirm what a suspicious connection really contained.
Who uses it?
Network engineers, SOC analysts, incident responders and students.
Pros
- Free and open source
- Shows exactly what crossed the wire
- Great for learning protocols
Cons
- Captures can be huge and hard to search
- Encrypted traffic stays opaque
- Not built for continuous monitoring
