How to Use Wireshark to Capture, Filter and Inspect Packets. Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human readable format. Wireshark includes filters, color coding, and other features that let you dig deep into network traffic and inspect individual packets. This tutorial will get you up to speed with the basics of capturing packets, filtering them, and inspecting them. You can use Wireshark to inspect a suspicious programs network traffic, analyze the traffic flow on your network, or troubleshoot network problems. Getting Wireshark. You can download Wireshark for Windows or mac. This Salesforce video training course with Jim Anthony covers how to set up and use Salesforce. I mentioned in my Tcpdump Masterclass that Wireshark is capable of decrypting SSLTLS encrypted data in packets captured in any supported format and that if anyone. I just installed Wireshark, but when I click capture interfaces, the dialog box appears, but it does not contain my network interface. When click on capture. OS from its official website. If youre using Linux or another UNIX like system, youll probably find Wireshark in its package repositories. For example, if youre using Ubuntu, youll find Wireshark in the Ubuntu Software Center. Just a quick warning Many organizations dont allow Wireshark and similar tools on their networks. Dont use this tool at work unless you have permission. Capturing Packets. After downloading and installing Wireshark, you can launch it and double click the name of a network interface under Capture to start capturing packets on that interface. For example, if you want to capture traffic on your wireless network, click your wireless interface. You can configure advanced features by clicking Capture Options, but this isnt necessary for now. As soon as you click the interfaces name, youll see the packets start to appear in real time. Wireshark captures each packet sent to or from your system. If you have promiscuous mode enabledits enabled by defaultyoull also see all the other packets on the network instead of only packets addressed to your network adapter. To check if promiscuous mode is enabled, click Capture Options and verify the Enable promiscuous mode on all interfaces checkbox is activated at the bottom of this window. Click the red Stop button near the top left corner of the window when you want to stop capturing traffic. Color Coding. Youll probably see packets highlighted in a variety of different colors. Wireshark uses colors to help you identify the types of traffic at a glance. By default, light purple is TCP traffic, light blue is UDP traffic, and black identifies packets with errorsfor example, they could have been delivered out of order. There are some points that are not clear in your statement. First, program A most likely uses TCP or UDP perhaps raw IP, so strictly speaking its not producing. To view exactly what the color codes mean, click View Coloring Rules. You can also customize and modify the coloring rules from here, if you like. Sample Captures. If theres nothing interesting on your own network to inspect, Wiresharks wiki has you covered. The wiki contains a page of sample capture files that you can load and inspect. Click File Open in Wireshark and browse for your downloaded file to open one. You can also save your own captures in Wireshark and open them later. Click File Save to save your captured packets. Filtering Packets. If youre trying to inspect something specific, such as the traffic a program sends when phoning home, it helps to close down all other applications using the network so you can narrow down the traffic. Still, youll likely have a large amount of packets to sift through. Thats where Wiresharks filters come in. The most basic way to apply a filter is by typing it into the filter box at the top of the window and clicking Apply or pressing Enter. For example, type dns and youll see only DNS packets. When you start typing, Wireshark will help you autocomplete your filter. You can also click Analyze Display Filters to choose a filter from among the default filters included in Wireshark. From here, you can add your own custom filters and save them to easily access them in the future. For more information on Wiresharks display filtering language, read the Building display filter expressions page in the official Wireshark documentation. Another interesting thing you can do is right click a packet and select Follow  TCP Stream. Youll see the full TCP conversation between the client and the server. You can also click other protocols in the Follow menu to see the full conversations for other protocols, if applicable. Close the window and youll find a filter has been applied automatically. Wireshark is showing you the packets that make up the conversation. Inspecting Packets. Click a packet to select it and you can dig down to view its details. You can also create filters from here just right click one of the details and use the Apply as Filter submenu to create a filter based on it. Wireshark is an extremely powerful tool, and this tutorial is just scratching the surface of what you can do with it. Professionals use it to debug network protocol implementations, examine security problems and inspect network protocol internals. You can find more detailed information in the official Wireshark Users Guide and the other documentation pages on Wiresharks website. Using Wireshark to Decode SSLTLS Packets. I mentioned in my Tcpdump Masterclass that Wireshark is capable of decrypting SSLTLS encrypted data in packets captured in any supported format and that if anyone wanted to know how for them to ask. Someone did, so here it is. This is an extremely useful Wireshark feature, particularly when troubleshooting within highly secure network architectures. This article examines the requirements and Wireshark configuration required to do so and provides some information on issues commonly encountered when using this feature. Note Ive now also written a version of this article but using ssldump for real time decryption at the command line. Isnt SSLTLS SecureDont let this article give you the impression its not as youll see from the next section, theres a good deal of requirements that must be met. However, there are plenty of other reasons to consider it insecure. If youre reading this article and youre responsible for and careabout the privacy and security of your traffic, please keep in mind that SSLTLS, in reality, presents no more than a faade of security today in the same way money apparently represents real value and different sex marriages normality and stability. Ignoring our post PRISM world for a moment everyone is anyway right from a technical standpoint SSLv. You really shouldnt be using it however, dont just use v. TLS and consider that enough to offer a good security posture. How its configured and the options and ciphers you allow or not are far more important, but thats an article for another day. Taking PRISMs and other countrys similar programs implications into account, frequent technical weaknesses exploited through techniques such as BEAST or BREACH, the ease with which a fake CA can be installed on most devices and the decidedly risky nature of trusting any Certificate Authorities CAs after recent scandals and revelations, Id have a hard time convincing anyone to use SSLTLS. That is, if there was an alternative, which there isnt. It probably doesnt matter anyway, why try and break encryption when you can just knock on the door and ask politely like most government agencies and police forces can in some form or other. I use self signed certificates for the on line services I run for myself theres a reason I run them myself. Any false security I may have had around any large organisation including government being as fallible and poorly organised as the people within it and unable to consume the necessary volume of information to be effective without genuinely prohibitive expense has vanished in recent years. Again, you can read more about that in a later article Im far from a security pro so take this whole section with a pinch of salt. Requirements. I know this list seems pretty long I dont think thats necessarily a bad thing if you cant meet all these requirements, you probably shouldnt be attempting to decrypt the data. As ever, preparation is key if you think youll need to do this even if just once a month, find out what you need to do to make meeting these prerequisites less onerous. On Linux systems Wire. Shark must be compiled against Gnu TLS and GCrypt, not Open. SSL or some other encryption suite not something to worry about on Windows systems. The private key used to encrypt the data must be available on the system running Wireshark. The private key file must be in the PEM or PKCS1. Open. SSL to convert what you have as appropriate, just Google it. The private key file should only contain the private key, not the public key aka the certificate. Files frequently contain both, check by viewing the file in a true text editor. You only need the text delimited by this. Header BEGIN RSA PRIVATE KEYFooter END RSA PRIVATE KEYAny PEM private key file must not have a passphrase. It seems this is no longer an issue. RSA keys must have been used to encrypt the data. The capture must include both sides of a conversation. In other words, the capture must include the full client and server exchange. Important The capture must include the initial SSLTLS session establishment. In other words, the CLIENTHELLO and SERVERHELLO exchange. Beware captures taken where a session has been resumed. Ideally, ensure any capture either a is of packets related to an entirely new device connecting or b where a device that has already previously established a session is used, it is used after a considerable time after the last session was established. Important Ensure the use of a Diffie Hellman Ephemeral DHEEDH or RSA Ephemeral cipher suite is not negotiated between the two hosts. This is indicated by the use of a Server. Key. Exchange message. There is no way to decrypt data where ephemeral ciphers are used. Configuring Wireshark to Decrypt Data. In Wireshark click Edit PreferencesSelect and expand Protocols, scroll down or just type ssl and select SSLClick the RSA Keys List Edit button, click New and then enter the following information IP Address is the IP address of the host that holds the private key used to decrypt the data and serves the certificate i. Port is the destination port used to communicate with the host that holds the private key used to decrypt the data and serves the certificate i. Protocol is the upper layer protocol encrypted by SSLTLS, for instance, the protocol encrypted over a HTTPS web connection is HTTPKey File select as necessary. Password is the passphrase used to protect the private key file, if any. I believe a wildcard IP address of 0. Optionally, enter the path and file name of a debug file that you might find useful in helping you diagnose any issues with the decryption. Note this may slow down the initial load of the capture file. Then simply open the capture and, if youve met all the requirements, you should find the application data has been unencrypted. If the standard SSLTLS port isnt being used you may need to select a relevant packet and then click Analyse Decode As and then select SSL. Allowing Others to Decrypt Without The Private Key. Thanks to Jens for his comments below around extracting the session keys from a decrypted capture therefore avoiding sending a vendor or other party that you want to see the unencrypted data your valuable private key. Rsview32 Scada Software more. To do this, decrypt the capture as detailed above and then click File Export SSL Session Keys, provide a file name and save to an appropriate location. You can then send this file, along with the capture to someone you wish to decrypt the captured data all they then need to do is Load the capture in Wireshark and then click Edit PreferencesSelect and expand Protocols, scroll down or just type ssl and select SSLClick the Browse button to the right of Pre Master Secret log filename and select the session key filename that you also sent to them. Cloudshark also tweeted to say in Cloud. Shark you can keep your keys secure decode without sharing I was rather dubious about the security or rather lack of it of providing keys to a cloud service but it turns out they now provide appliances. Thus your keys truly remain under your control and you can provide access to decoded captures without having to provide your keys. However, I assume this means you need to provide access to your appliances interface. Notes Issues. Ensure youve met all the requirements listed earlier. Wireshark can only decrypt SSLTLS packet data if RSA keys are used to encrypt the data.