Protocol Analysis

Wireshark dissects over 3,000 protocols. Understanding the most common ones — TCP, UDP, HTTP, DNS, and SSL/TLS — is essential for effective network troubleshooting and security analysis.

Tip

To see all dissectors installed, go to Help > About Wireshark > Plugins. You can also write custom Lua dissectors for proprietary protocols.

TCP — Transmission Control Protocol

Common display filters for TCP analysis:

wireshark

tcp

All TCP traffic

wireshark

tcp.port == 80

TCP on port 80

wireshark

tcp.flags.syn == 1

TCP SYN packets

wireshark

tcp.analysis.retransmission

Retransmissions

wireshark

tcp.analysis.lost_segment

Lost segments

Key Fields

tcp.srcport, tcp.dstport, tcp.seq, tcp.ack, tcp.len, tcp.flags, tcp.window_size

UDP — User Datagram Protocol

Common display filters for UDP analysis:

wireshark

udp

All UDP traffic

wireshark

udp.port == 53

UDP DNS traffic

wireshark

udp.length > 100

Large UDP packets

Key Fields

udp.srcport, udp.dstport, udp.length, udp.checksum

HTTP — Hypertext Transfer Protocol

Common display filters for HTTP analysis:

wireshark

http

All HTTP traffic

wireshark

http.request

HTTP requests only

wireshark

http.response

HTTP responses only

wireshark

http.request.method == "GET"

GET requests

wireshark

http.response.code == 404

404 Not Found responses

Key Fields

http.host, http.uri, http.method, http.user_agent, http.cookie, http.referer

DNS — Domain Name System

Common display filters for DNS analysis:

wireshark

dns

All DNS traffic

wireshark

dns.qry.name contains "google"

Queries containing "google"

wireshark

dns.flags.response == 0

DNS queries (not responses)

wireshark

dns.flags.rcode != 0

DNS errors

Key Fields

dns.qry.name, dns.qry.type, dns.resp.name, dns.a, dns.aaaa

SSL/TLS — Secure Sockets Layer / Transport Layer Security

Common display filters for SSL/TLS analysis:

wireshark

ssl

All SSL/TLS traffic

wireshark

ssl.handshake.type == 1

Client Hello

wireshark

ssl.handshake.type == 2

Server Hello

wireshark

tls.handshake.extensions_sni

SNI extension present

Key Fields

ssl.handshake.version, tls.handshake.ciphersuite, ssl.record.content_type

ICMP — Internet Control Message Protocol

Common display filters for ICMP analysis:

wireshark

icmp

All ICMP traffic

wireshark

icmp.type == 8

Echo Request (ping)

wireshark

icmp.type == 0

Echo Reply (ping reply)

wireshark

icmp.type == 3

Destination Unreachable

Key Fields

icmp.type, icmp.code, icmp.data_time, icmp.checksum

TCP Three-Way Handshake

Understanding the TCP handshake is fundamental. Here is how Wireshark shows it:

SYN

Client sends a SYN packet to initiate connection. Filter: tcp.flags.syn == 1 and tcp.flags.ack == 0

SYN-ACK

Server responds with SYN and ACK flags. Filter: tcp.flags.syn == 1 and tcp.flags.ack == 1

ACK

Client sends final ACK. Connection established. Filter: tcp.flags.syn == 0 and tcp.flags.ack == 1

Analyzing Conversations

Use Statistics > Conversations to see all unique connections between endpoints, sorted by packet count or bytes.

Warning

When following a TCP stream (Right-click > Follow > TCP Stream), the display filter is automatically set to that stream. Click Clear to remove it.

Next: Troubleshooting Back