Capture and Analyze Network Traffic with Wireshark for Diagnostics

Introduction

This document describes how to use Wireshark to capture and analyze network traffic for diagnostic purposes.

Overview

Wireshark is a free application you can use to read and analyze packet captures (also called "TCP dumps"). Packet captures reveal all communications through a network adapter at the packet level, making it possible to view DNS, HTTP, ping, and other traffic types. Packet captures are especially valuable as a diagnostic step for deep troubleshooting and, with the introduction of SIG, are now a fundamental part of the diagnostic process.

Note: Wireshark captures all traffic on the selected adapter. Because packet captures often contain personally identifiable information (PII), always use a secure method, such as a Box link, to share capture files with support.

Get Wireshark

You can download Wireshark for Windows, macOS, or Linux at: https://www.wireshark.org/

Gather a Packet Capture

1. Choose the network adapter connected to the internet and start the capture in Wireshark.
2. While capturing, reproduce the issue you want to diagnose.
3. Stop the capture when finished and save the file as a.pcap.

Basic Ports and Protocols

• Most packets communicate on the transport layer protocols TCP or UDP
  • For example, "DNS" runs "on top of" UDP by default. It switchs to UDP if TCP fails.
• HTTP and DNS are common protocols that run on a combination of transport protocol + ports.

Knowing protocol names, ports, and their uses helps you identify and analyze relevant traffic in Wireshark.

Basic Operators

When building filter strings in Wireshark, use these operators:

• ==: Equals (Example:ip.dst==1.2.3.4)
• !=: Not Equal (Example:ip.dst!=1.2.3.4)
• &&: And (Example:ip.dst==1.2.3.4 && ip.src==208.67.222.222)
• ||: Or (Example:ip.dst==1.2.3.4 || ip.dst==1.2.3.5)

For advanced filter options, refer to the Wireshark documentation: 6.4. Building Display Filter Expressions

Filters

Packet captures can contain thousands of packets. Filters help you focus on specific traffic types:

• By protocol:

  • dns— Show only DNS traffic
  • http || dns— Show HTTP or DNS traffic

• By IP address:

  • ip.addr==<IP>— All traffic to/from<IP>
  • ip.src==<IP>— All traffic from<IP>
  • ip.dst==<IP>— All traffic to<IP>

• Miscellaneous:

  • tcp.flags.reset==1— Check for TCP resets (timeouts)
  • dns.qry.name contains "[domain]"— DNS queries matching a domain
  • tcp.port==80 || udp.port==80— TCP or UDP traffic on port 80

Viewing and Analyzing Packets

After locating a packet, expand the segments within Wireshark to analyze details. Familiarity with protocol structure helps you interpret these details and even reconstruct data if needed.

Following a Data Stream

Use the packet list to locate request and response pairs. Right-click on a packet and select Follow > TCP Stream, UDP Stream, TLS Stream, or HTTP Stream to view the related request and response sequence.

• This is more useful with protocols that have multiple exchanges (for example, HTTP) than with single-request protocols (for example, DNS).