Cheatsheet Wireshark
Analisador de protocolos de rede para segurança e diagnóstico
Wireshark
25
cards found
Categories:
Versions:
Capture
Start / Stop
Ctrl + E (start capture)
Ctrl + E (stop capture)
Ctrl + K (restart capture)
Ctrl + Shift + K (capture with options)
Control packet capture.
Interfaces
Ctrl + I (choose interface)
Ctrl + Shift + I (capture options)
# Select: Wi-Fi, Ethernet,
# Loopback, Any
Choose a network interface.
File
Ctrl + O (open .pcap)
Ctrl + S (save capture)
Ctrl + Shift + S (save the)
Ctrl + W (close)
Open and save captures.
Capture with Filter
# Capture filter (BPF):
tcp port 80
host 192.168.1.1
not arp and not icmp
tcp portrange 1-1024
Filter while capturing.
Display Filters
Basic Filters
http
dns
tcp
udp
icmp
arp
tls
Filter by protocol.
HTTP Filters
http.request.method == "POST"
http.response.code == 404
http.host == "example.com"
http contains "password"
http.request.uri contains "admin"
Inspect web traffic.
Filter by IP
ip.addr == 192.168.1.100
ip.src == 10.0.0.1
ip.dst == 10.0.0.2
ip.addr == 192.168.1.0/24
Filter by address.
Filter by Port
tcp.port == 443
tcp.dstport == 8080
udp.port == 53
tcp.port != 22
Filter by port.
Logical Operators
http && ip.addr == 10.0.0.1
dns || icmp
!arp
tcp.flags.syn == 1 && tcp.flags.ack == 0
Combine conditions.
Navigation
Move Between Packets
Ctrl + ↓ (next packet)
Ctrl + ↑ (previous packet)
Ctrl + Home (first packet)
Ctrl + End (last packet)
Ctrl + G (go to packet #)
Navigate the list.
Panes
Ctrl + Shift + L (packet list)
Ctrl + Shift + D (details)
Ctrl + Shift + B (bytes/hex)
Ctrl + T (toggle time display)
Switch between panes.
Mark and Jump
Ctrl + M (mark packet)
Ctrl + Shift + M (go to marked)
Ctrl + Shift + A (go to previous marked)
Ctrl + . (next marked)
Mark important packets.
Search
Ctrl + F (search)
Ctrl + Shift + F (find next)
Ctrl + / (filter bar)
Ctrl + Shift + / (capture filter bar)
Locate packets.
Analysis
Follow TCP Stream
Right-click → Follow → TCP Stream
# Or shortcut:
Ctrl + Shift + T (follow TCP)
Ctrl + Shift + U (follow UDP)
Ctrl + Shift + H (follow HTTP)
View the full conversation.
Statistics
Statistics → Conversations
Statistics → Endpoints
Statistics → Protocol Hierarchy
Statistics → I/O Graphs
Statistics → Flow Graph
Statistical analysis.
Colorize Packets
Right-click → Colorize → choose color
# Coloring rules:
View → Coloring Rules
Ctrl + Shift + C (manage rules)
Highlight visually.
Decode As
Right-click → Decode As...
# Example: port 8443 the HTTP
# Or a custom port the TLS
Force protocol interpretation.
Security
Detect Scans
tcp.flags.syn == 1 && tcp.flags.ack == 0
# Many SYN connections without ACK
# from a single IP = port scan
Statistics → Conversations → TCP tab
Identify port scanning.
Plaintext Credentials
http contains "password"
http contains "login"
http.authorization
ftp.request.command == "PASS"
smtp contains "AUTH"
Detect unencrypted data.
DNS Analysis
dns.flags.response == 0
dns.qry.name contains "malware"
dns.flags.rcode == 3 # NXDOMAIN
Statistics → DNS
Monitor DNS queries.
Suspicious Traffic
tcp.flags.reset == 1 # RST floods
icmp.type == 8 # ping sweep
arp.duplicate-address-detected
tcp.analysis.retransmission
Identify anomalies.
Advanced
Export Objects
File → Export Objects → HTTP
File → Export Objects → SMB
File → Export Objects → TFTP
# Extract transferred files
Extract files from the capture.
Export Packets
File → Export Specified Packets
File → Export Packet Dissections
# Formats: pcapng, pcap, CSV,
# JSON, XML, C arrays
Save subsets.
tshark (CLI)
tshark -i eth0 -f "tcp port 80"
tshark -r capture.pcap -Y "http"
tshark -i any -w output.pcap
tshark -r file.pcap -T fields \
-e ip.src -e http.host
Wireshark on the command line.
IO Graph and Performance
Statistics → I/O Graphs
# Per-graph filters:
# "tcp.analysis.retransmission"
# "http.response.code >= 500"
Statistics → TCP Stream Graphs
Visualize traffic over time.