Advanced Features

Once you are comfortable with basic captures and filters, Wireshark offers powerful advanced tools for deep analysis: stream reconstruction, expert info, statistics, and custom dissectors.

Follow TCP/UDP/SSL Streams

Wireshark can reassemble the full payload of a conversation. Right-click any packet and select Follow > TCP Stream (or UDP/SSL).

Stream View Options

Entire conversation — Both directions combined
One direction — Client to server or server to client only
ASCII / Hex / Raw — Switch between readable text and raw bytes

Stream Filters

1# Filter for a specific TCP stream
2tcp.stream eq 5
3 
4# Filter for SSL stream (decrypted if keys provided)
5ssl.stream eq 2

Expert Information

Analyze > Expert Information shows a categorized summary of anomalies: errors, warnings, notes, and chats. This is incredibly useful for spotting issues at a glance.

Severity	Examples
Error	Malformed packets, checksum errors
Warning	Retransmissions, out-of-order packets, duplicate ACKs
Note	TCP window full, zero-window probes
Chat	Regular TCP segments, keep-alives

IO Graphs

Statistics > IO Graphs lets you visualize traffic over time. You can plot packets per second, bytes per second, or apply custom display filters to each graph line.

Graph Configuration Tips

Add multiple lines with different colors for different protocols
Use tcp.analysis.retransmission line to spot retransmission spikes
Change the Y-axis unit to bytes, packets, or logarithmic scale

Statistics Menu

Wireshark provides built-in statistics for high-level overview. Here is a quick reference:

Protocol Hierarchy

Breakdown of protocols by packet count and bytes

Conversations

Unique connections between endpoints

Endpoints

All unique IPs, MACs, or ports seen

HTTP

Request/response statistics, status codes, hosts

DNS

Query/response statistics, RTT times

Flow Graph

Visual timeline of a single TCP connection

TCP Stream Graphs

Round-trip time, throughput, window scaling

Packet Lengths

Distribution of packet sizes

Decrypting SSL/TLS

Wireshark can decrypt SSL/TLS if you provide the session keys. This requires capturing the (pre)-master secret.

SSL Decryption Setup

1# On the client machine, set environment variable before starting browser
2export SSLKEYLOGFILE=/tmp/ssl-keys.log
3 
4# In Wireshark: Edit > Preferences > Protocols > TLS
5# Point "(Pre)-Master-Secret log filename" to /tmp/ssl-keys.log

Important

Only decrypt traffic you own or have explicit permission to analyze. Storing SSL keys creates a significant security risk — handle key log files with extreme care.

Custom Dissectors (Lua)

For proprietary or unsupported protocols, you can write Lua dissectors. Place them in your Wireshark plugins directory.

custom_dissector.lua

1-- Simple Lua dissector example
2local my_proto = Proto("myproto", "My Protocol")
3local f_type = ProtoField.uint8("myproto.type", "Type", base.DEC)
4local f_data = ProtoField.bytes("myproto.data", "Data")
5my_proto.fields = { f_type, f_data }
6 
7function my_proto.dissector(buffer, pinfo, tree)
8    local subtree = tree:add(my_proto, buffer())
9    subtree:add(f_type, buffer(0,1))
10    subtree:add(f_data, buffer(1))
11    pinfo.cols.protocol = "MYPROTO"
12end
13 
14local udp_table = DissectorTable.get("udp.port")
15udp_table:add(9999, my_proto)

Next: Protocol Analysis Back