Lesson 3 of 9

Packet Analysis with Wireshark

Wireshark is the world's most widely used network protocol analyzer and an indispensable tool for both attackers and defenders. You will learn to capture, filter, and reconstruct network sessions to extract meaningful intelligence from raw packet data. Mastering Wireshark allows you to see exactly what is happening on a network at any given moment.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Master Wireshark capture and display filters. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Packet Analysis with Wireshark · Objective 1 of 4

VIDEO

Loading video…

Open a sample capture

Download the http.cap sample file from the Wireshark wiki at wiki.wireshark.org/SampleCaptures and open it in Wireshark using File > Open. This pre-recorded capture contains real HTTP traffic and is ideal for analysis practice because you can repeat the exercise as many times as needed. Alternatively, record your own HTTP capture by visiting a plain HTTP site while Wireshark is running. Confirm the capture loaded correctly by checking that the packet list is populated and the protocol column shows a mix of TCP and HTTP entries.

Filter for HTTP GET requests

In the display filter bar, type 'http.request.method == "GET"' and press Enter to isolate only HTTP GET requests. This filter is more precise than simply typing 'http' because it excludes POST requests, responses, and other HTTP traffic. You should see a list of requests for web resources such as HTML pages, images, and scripts. Note the Host and URI fields in each packet — together they form the full URL that was requested, which is valuable intelligence in a real investigation.

Follow a TCP stream

Right-click any HTTP GET packet and choose Follow > TCP Stream to reconstruct the full HTTP request and response conversation. The client request will appear in red and the server response in blue, including all HTTP headers and the response body. Look for sensitive headers such as Set-Cookie, Authorization, or X-Powered-By that reveal information about the server. This technique is used in real investigations to recover web sessions, extract credentials, and identify the exact content a user downloaded.

Export HTTP objects

Navigate to File > Export Objects > HTTP in the Wireshark menu to open the HTTP object export dialog. This dialog lists every file transferred over HTTP in the capture, including HTML pages, images, JavaScript files, and any other downloaded content. Select all objects and click Save All to export them to a folder on your desktop. In a forensic investigation, this technique can recover files that were downloaded by a suspect, including malware, documents, and images — making it one of the most powerful features in Wireshark for incident response.

Previous: Network Protocols Deep Dive Next Lesson