Wireshark Fundamentals for Offensive Recon: Capture & Filter Traffic

Introduction

Wireshark is the de‑facto standard packet analyzer used by network engineers, incident responders, and penetration testers alike. In the offensive security workflow, raw packet captures (PCAPs) are gold mines: they reveal live services, mis‑configurations, clear‑text credentials, and hidden communication channels that can be leveraged for further exploitation.

This guide walks you through the practical steps required to turn a bare‑metal laptop or a compromised host into a stealthy reconnaissance sensor. We cover installation on the three major operating systems, interface selection, BPF capture filters, Wireshark’s powerful display filters, and the safe export of sanitized PCAPs for offline analysis.

Real‑world relevance: During the 2023 Red Team engagements at a Fortune‑500 firm, a single well‑crafted capture filter on a compromised Windows workstation uncovered an internal LDAP service exposing privileged accounts. The same technique can be applied to any target network to surface high‑value secrets before the blue team even knows you’re there.

Prerequisites

• Solid understanding of the TCP/IP stack (OSI layers, IP addressing, ports, and common protocols).
• Basic familiarity with network sniffing concepts (promiscuous mode, NIC drivers, and raw sockets).
• Administrative or root access on the host you intend to run Wireshark.
• Optional but recommended: a sandbox or isolated lab environment to practice without risking production traffic.

Core Concepts

Before diving into the GUI, it is essential to internalize a few core ideas:

• Capture vs. Display Filters – Capture filters (BPF syntax) are applied by the capture engine before packets touch disk, reducing storage and noise. Display filters are evaluated by Wireshark after the capture, allowing you to slice and dice the data without re‑capturing.
• Promiscuous vs. Non‑Promiscuous Mode – In promiscuous mode the NIC forwards *all* frames it sees, not just those addressed to it. Some networks (e.g., switched VLANs with port security) will drop or tag packets that are not destined for the host, limiting the value of promiscuous capture.
• Ring Buffers & File Rotation – Long‑running captures can fill disks quickly. Wireshark/tshark can automatically rotate files based on size or duration, a technique frequently used by red teams to avoid detection.

Figure 1 (described): A simple diagram showing a laptop with Wireshark in promiscuous mode attached to a switch, capturing traffic from multiple hosts on the same VLAN.

Installing and configuring Wireshark on various platforms

Linux (Debian/Ubuntu family)

sudo apt updatesudo apt install -y wireshark# Add your user to the wireshark group to allow non‑root capturessudo usermod -aG wireshark $USERnewgrp wireshark

During installation, the package will ask whether non‑root users should be able to capture packets. Answer “Yes” to avoid running Wireshark as root – a common security pitfall.

Linux (Red Hat/Fedora family)

sudo dnf install wireshark wireshark-clisudo usermod -a -G wireshark $USERnewgrp wireshark

macOS

Use Homebrew for a quick install:

brew updatebrew install wireshark# Optional: install the command‑line tool onlybrew install wireshark --with-qt

After installation, you may need to grant the “Access to Network Interfaces” permission in System Preferences → Security & Privacy → Privacy.

Windows

1. Download the latest stable MSI from wireshark.org.
2. Run the installer. When prompted, select “Install Npcap” (the modern packet capture driver) and enable the option “Allow non‑admin users to capture packets”.
3. Reboot the machine (Npcap requires a reboot to install its driver).
4. Launch Wireshark from the Start menu; you should see a list of interfaces without needing “Run as administrator”.

Tip: On Windows, the “Capture Options” dialog includes a checkbox for “Promiscuous mode”. Leave it unchecked unless you have a reason to believe the target network does not filter frames.

Selecting the correct capture interface and handling promiscuous mode

Wireshark lists every network interface it can see – physical NICs, virtual adapters (VPN, Docker, WSL), and loopback. Choosing the wrong interface can result in empty captures or noisy data.

Identifying the right interface

• Run tshark -D (Linux/macOS) or wireshark -D (Windows) to enumerate interfaces with their descriptive names.
• Look for the interface with the highest traffic counter when you generate test traffic (e.g., ping -c 5 8.8.8.8).
• On a compromised host, you may need to capture on a virtual interface (e.g., vEthernet (DockerNAT)) to see intra‑container traffic.

Promiscuous mode considerations

Enabling promiscuous mode on a switched network can be noisy but also raises the risk of detection. Red teams often:

1. Start with non‑promiscuous capture to see only traffic destined for the host.
2. If necessary, enable promiscuous mode for a short window (timeout 30 wireshark -i eth0 -k -Y \"tcp.port==22\") and then disable it.
3. Use -p flag in tshark to force non‑promiscuous mode: tshark -i eth0 -p -w capture.pcap.

Many modern NICs support “monitor mode” (especially on wireless) which is even more stealthy; however, monitor mode on Wi‑Fi can expose management frames that are rarely needed for offensive recon.

Using capture filters (BPF syntax) to limit collected data

Capture filters are written in the Berkeley Packet Filter (BPF) language. They are evaluated in kernel space, meaning they have zero impact on performance and storage.

Basic syntax

• host 10.0.0.5 – capture any packet to or from 10.0.0.5.
• net 192.168.1.0/24 – restrict to a subnet.
• port 80 – capture traffic on TCP or UDP port 80.
• tcp port 443 – limit to TCP only.
• not arp – exclude ARP packets.

Combining expressions

Use logical operators and, or, and not. Parentheses are supported for grouping.

# Capture only HTTP GET traffic from the target subnettcp port 80 and ((src net 10.10.0.0/16) or (dst net 10.10.0.0/16))# Capture all DNS (UDP 53) except from the attacker's own IPudp port 53 and not src host 192.168.10.42

Practical examples for offensive recon

• Credential hunting: tcp port 21 or tcp port 22 or tcp port 23 – capture clear‑text login attempts to FTP, SSH (if using password auth), and Telnet.
• Service enumeration: tcp portrange 1-1024 and not src host $ATTACKER_IP – gather banners from a wide port range while ignoring your own traffic.
• Internal traffic: net 10.0.0.0/8 and not host $ATTACKER_IP – focus on the internal backbone, ignoring outbound Internet chatter.

When using the GUI, the capture filter box sits at the top of the “Capture Options” dialog. In tshark, the -f flag applies a capture filter:

tshark -i eth0 -f \"tcp port 80 and src net 10.0.0.0/8\" -w http_internal.pcap

Applying display filters to isolate protocols of interest

Once you have a PCAP, Wireshark’s display filter language lets you drill down without re‑capturing. Display filters are more expressive than BPF and can reference protocol fields, flags, and even decode custom dissectors.

Syntax basics

• http.request.method == \"GET\" – show only HTTP GET requests.
• tls.handshake.type == 1 – filter TLS ClientHello messages.
• dns.qry.name contains \"admin\" – locate DNS queries for admin‑related hosts.
• tcp.flags.syn == 1 and tcp.flags.ack == 0 – isolate SYN packets (new connections).

Complex filters

Combine multiple criteria using && (and) and || (or). Example: find SMB authentication attempts from a specific host.

ip.addr == 10.0.5.23 && smb2.cmd == 0x73 && smb2.status == 0x00000000

Saving & reusing filters

In the Wireshark UI, you can click the “+” button next to the display filter bar to add named filters to your profile. This is handy for a red‑team checklist such as:

• \"Clear‑text credentials\" – tcp contains \"password\" || tcp contains \"login\"
• \"Internal LDAP\" – ldap && ip.src == 10.0.0.0/8
• \"Potential C2\" – tcp.port == 4444 || udp.port == 4444

Exporting and sanitizing PCAP files for offline analysis

After a successful capture, you often need to move the PCAP to a forensic workstation for deeper analysis, or share it with a teammate while ensuring no accidental leakage of privileged data.

Exporting from Wireshark

1. File → Export Specified Packets…
2. Choose \"Displayed\" to export only packets that match your current display filter.
3. Select the desired format (PCAPNG is preferred for preserving comments and metadata).
4. Optionally enable \"Compress file using gzip\" to reduce size and add a layer of obfuscation.

Sanitizing sensitive fields

Wireshark can redact fields before export:

# Using editcap to strip payloadseditcap -F pcapng -s 64 original.pcap sanitized.pcap# -s 64 truncates each packet to 64 bytes (enough for headers only)

For a more surgical approach, use tshark with -R (read filter) and -w to write only selected fields:

tshark -r original.pcap -Y \"http\" -T fields -e ip.src -e http.host -e http.request.uri -E separator=, -w http_summary.csv

When sharing with a blue‑team partner, remove any Authorization: Basic headers, Kerberos tickets, or internal IP addresses that could be used for lateral movement.

Practical Examples

Example 1 – Harvesting internal web traffic on a compromised host

1. Start Wireshark on the host, select eth0, disable promiscuous mode.
2. Apply capture filter: tcp port 80 and not src host 192.168.1.100 (exclude your own IP).
3. After 5 minutes, stop the capture.
4. Apply display filter: http.request.method == \"POST\" && http.request.uri contains \"login\" to isolate credential submissions.
5. Export displayed packets, then run editcap -s 64 to strip payloads before sending to the analysis server.

Example 2 – Detecting hidden C2 over DNS

# Capture only DNS queries that have > 30 bytes of payload (possible tunneling)sudo tshark -i eth0 -f \"udp port 53\" -w dns_c2.pcap -a duration:300# After capture, filter for suspicious queriestshark -r dns_c2.pcap -Y \"dns.qry.name matches \"^[a-z0-9]{20,}\\\.example\\.com$\"\" -w suspicious_dns.pcap

This technique looks for long, random subdomains – a hallmark of DNS tunneling tools like Iodine.

Tools & Commands

• Wireshark GUI – visual analysis, live capture, built‑in decryption for TLS if you have the pre‑master secret.
• tshark – command‑line counterpart for scripting. Example: tshark -i wlan0 -f \"tcp port 443\" -w ssl.pcap.
• editcap – trim, reorder, or anonymize PCAPs.
• capinfos – quick summary: capinfos -a -e -c capture.pcap.
• mergecap – combine multiple captures into one for cross‑host analysis.

Defense & Mitigation

From a defender’s perspective, limiting an adversary’s ability to sniff traffic is essential:

• Enable port security on switches – limit the number of MAC addresses per port and disable rogue promiscuous NICs.
• Use encrypted protocols (TLS, SSH, IPsec) wherever possible; encrypted payloads render most sniffed data useless.
• Network segmentation – isolate high‑value assets onto separate VLANs with ACLs that block inter‑VLAN sniffing.
• Deploy IDS/IPS signatures that look for unusual capture tools (e.g., Npcap driver load events, tshark process executions).
• Audit endpoint configurations – ensure users cannot install Npcap or WinPcap without admin approval.

Common Mistakes

• Running Wireshark as root – Increases the attack surface; always use the least‑privilege user with capture rights.
• Capturing on the wrong interface – Leads to empty PCAPs; verify with ifconfig/ip a before starting.
• Forgetting to disable promiscuous mode on a switched network – Generates massive, noisy captures that can raise alarms.
• Exporting full PCAPs without sanitization – May leak credentials to teammates or forensic tools.
• Using display filters as capture filters – They are evaluated after the fact and do not reduce storage or performance.

Real-World Impact

In a 2022 supply‑chain breach, the attackers used a compromised VPN endpoint to run Wireshark with a BPF filter that captured only internal LDAP traffic. By focusing on tcp port 389, they harvested 1200 user objects in 30 seconds, enabling rapid privilege escalation across the enterprise.

Trend analysis: As organizations adopt zero‑trust networking, internal traffic is increasingly encrypted, pushing red teams toward side‑channel sniffing (e.g., DNS, HTTP/2 header compression leaks). Mastering Wireshark’s capture filters remains a foundational skill for spotting those subtle vectors.

Practice Exercises

1. Exercise 1 – Basic Capture: Install Wireshark on a Linux VM, start a capture on eth0 with filter tcp port 22. Generate SSH traffic from another VM and verify that only SSH packets appear in the capture.
2. Exercise 2 – Advanced BPF: Write a capture filter that records only outbound HTTP GET requests from the 10.10.0.0/16 subnet, excluding your own IP. Validate by browsing a website from the target subnet.
3. Exercise 3 – Display Filter Mastery: Load a pre‑captured PCAP (provided in the lab) and create a display filter that isolates TLS ClientHello messages containing the Server Name Indication (SNI) for intranet.corp.
4. Exercise 4 – Sanitization: Using editcap, truncate all packets in a PCAP to 64 bytes and verify that payload data is no longer present with tshark -x -r.
5. Exercise 5 – Red‑Team Scenario: Simulate a compromised host on a VLAN. Capture only DNS queries that are longer than 30 bytes, then extract the subdomains to a CSV file. Discuss how this data could be used for DNS tunneling detection.

Further Reading

• Wireshark Official User Guide – Chapter on Capture Filters.
• “Practical Packet Analysis” by Chris Sanders – deep dive into BPF syntax.
• RFC 791 – Internet Protocol.
• “The Art of Memory Forensics” – section on network artifact extraction.
• Tools: Wireshark source code, Linux kernel BPF implementation.

Summary

Wireshark is more than a GUI sniffer; it is a precision instrument for offensive reconnaissance when wielded with the right capture and display filters. By installing the tool securely, selecting the proper interface, applying lean BPF filters, and sanitizing exported PCAPs, you can collect high‑value intelligence while minimizing noise and detection risk. Mastery of these basics lays the groundwork for advanced techniques such as TLS decryption, covert channel analysis, and automated packet‑driven exploitation pipelines.