Wireshark: The Basics — Packet Navigation, Payload Carving, Diagnostic Views, and Traffic Filtering

Introduction

Welcome to my walkthrough of the room Wireshark: The Basics!

In my previous article, Networking Secure Protocols, we explored how cryptographic protocols like TLS, SSH, and VPNs safeguard communications across public infrastructure.

In this room, we step directly into packet analysis by learning how to navigate Wireshark's interface, dissect protocols, filter captures, and inspect raw traffic streams.

If you missed the previous entry in this series, you can catch up on my walkthrough for Networking Secure Protocols below.

What we will cover

• Wireshark Interface & Customization: Navigating the main display panes and setting up custom columns to streamline analysis.
• Packet Navigation & Search: Locating target strings, jumping between frames, and reading embedded packet comments.
• File & Payload Carving: Extracting raw bytes and exporting HTTP objects (such as images and text files) directly from captures.
• Diagnostic Views: Leveraging Expert Information to rapidly identify protocol anomalies and warning counts.
• Traffic Filtering & Stream Rebuilding: Applying dynamic display filters and following HTTP streams to reconstruct full web interactions.

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Wireshark: The Basics
• Path: Cyber Security 101
• Module: Networking
• Topic: Packet Analysis & Traffic Inspection
• Difficulty: Easy
• Room Link: TryHackMe — Wireshark: The Basics

Task 1: Introduction

Wireshark stands out as an open-source, cross-platform network packet analyzer built for sniffing live traffic and dissecting packet capture (PCAP) files. Operating as an essential tool for security analysts, it allows deep inspection into network packets across all layers of the network stack.

Throughout this room, we will build a foundation in Wireshark by configuring the interface, breaking down packets into their respective TCP/IP layers, applying display filters, and navigating traffic streams.

To follow along with the interactive walkthrough, launch the virtual machine in split-screen mode. The environment provides two separate packet captures: http1.pcapng serves as the sample file for reproducing screenshot steps, while Exercise.pcapng contains the data required to answer the task questions.

Questions and Answers

Which file is used to simulate the screenshots?

Answer:

http1.pcapng

http1.pcapng

Which file is used to answer the questions?

Answer:

Exercise.pcapng

Exercise.pcapng

Task 2: Tool Overview

Wireshark provides an extensive toolkit for network analysis, troubleshooting traffic congestion, identifying rogue hosts, and inspecting raw packet payloads. Rather than acting as an Intrusion Detection System (IDS), Wireshark operates as a passive analyzer reading network traffic without modifying it.

The main interface consists of five core components:

• Toolbar: Provides quick access to capture controls, display filters, and statistics.
• Display Filter Bar: Houses query syntax to narrow down captured traffic.
• Packet List Pane: Displays high-level packet summaries (frame number, timestamp, IPs, protocols).
• Packet Details Pane: Offers a hierarchical breakdown of the selected packet's OSI layers.
• Packet Bytes Pane: Shows the raw hexadecimal and ASCII representation of the packet data.

Beyond live sniffing, Wireshark allows analysts to merge multiple PCAP files via File -> Merge and extract vital metadata such as file hashes, capture time spans, and embedded comments.

Guided Walkthrough: Inspecting Capture File Properties

Analyzing file level metadata is essential when triaging incoming packet captures during an investigation.

To view global capture details, navigate to the top menu bar, select Statistics, and click Capture File Properties (or use the shortcut Ctrl+Alt+Shift+C).

Inside the Capture File Properties window, scroll down to the File Comment section. Here, analysts can read metadata left by capture authors or previous investigators, revealing the embedded flag.

To determine the total size of the capture, close the properties window and scroll to the very bottom of the Packet List Pane. The final frame index indicates that Exercise.pcapng contains 58620 packets.

Reopening Capture File Properties and viewing the File section near the top exposes exact file integrity metadata, including the SHA256 hash value.

Questions and Answers

Use the "Exercise.pcapng" file to answer the questions. Read the "capture file comments". What is the flag?

Answer:

TryHackMe_Wireshark_Demo

TryHackMe_Wireshark_Demo

What is the total number of packets?

Answer:

58620

58620

What is the SHA256 hash value of the capture file?

Answer:

f446de335565fb0b0ee5e5a3266703c778b2f3dfad7efeaeccb2da5641a6d6eb

f446de335565fb0b0ee5e5a3266703c778b2f3dfad7efeaeccb2da5641a6d6eb

Task 3: Packet Dissection

Packet dissection (or protocol dissection) is the process of decoding network bytes into readable protocol structures mapped against OSI model layers. Wireshark parses encapsulated frames from Layer 1 down to Layer 7:

• Frame (Layer 1 — Physical): Captures physical frame properties (arrival epoch, length, interface ID).
• Ethernet II (Layer 2 — Data Link): Details hardware source and destination MAC addresses.
• Internet Protocol Version 4 (Layer 3 — Network): Exposes IP headers, TTL, fragmentation flags, and source/destination IP addresses.
• Transmission Control Protocol (Layer 4 — Transport): Reveals source/destination ports, sequence numbers, window sizing, and payload length.
• Application Protocol (Layers 5–7 — Application): Interprets raw payload formats such as HTTP headers, FTP commands, or XML structures.

Guided Walkthrough: Analyzing Packet 38

To practice protocol dissection, select packet 38 from Exercise.pcapng and expand each OSI layer branch within the Packet Details Pane.

Expanding the Hypertext Transfer Protocol tree reveals an application data payload structured as eXtensible Markup Language (XML), indicated directly below the HTTP header fields.

Looking inside the HTTP response headers section, locate the Date field. The web server responded on 13 May 2004 (formatted as 05/13/2004).

To inspect network layer metadata, expand the Internet Protocol Version 4 tree. The Time to live (TTL) header field indicates a value of 47.

Collapsing IPv4 and opening Transmission Control Protocol exposes segment data. The bottom row of the TCP header breakdown shows TCP payload (424 bytes), confirming a payload size of 424.

Finally, return to the Hypertext Transfer Protocol header block and locate the entity tag (ETag) validator, which holds the string value "9a01a-4696–7e354b00".

Questions and Answers

Use the "Exercise.pcapng" file to answer the questions. View packet number 38. Which markup language is used under the HTTP protocol?

Answer:

eXtensible Markup Language

eXtensible Markup Language

What is the arrival date of the packet? (Answer format: Month/Day/Year)

Answer:

05/13/2004

05/13/2004

What is the TTL value?

Answer:

47

47

What is the TCP payload size?

Answer:

424

424

What is the e-tag value? (For example: 82ecb-6321–9e904585)

Answer:

9a01a-4696–7e354b00

9a01a-4696–7e354b00

Task 4: Packet Navigation

Efficient navigation is critical when searching through thousands of frames in large PCAP files. Wireshark provides several built-in mechanisms to locate specific data points, jump between frames, carve media, export objects, and view packet diagnostics.

For instance, the Find Packet tool (Ctrl+F) allows analysts to search across packet list details, display fields, or hex values using strings, regular expressions, or hex bytes. When a specific frame number is already known, the Go to Packet function (Ctrl+G) provides instant jumping directly to that frame in the capture.

For media extraction and payload recovery, the Export Packet Bytes feature (Ctrl+Shift+X) enables carving out specific stream data or embedded media directly from the Packet Details Pane. Alternatively, the Export Objects utility automatically extracts transferred files across supported protocols such as HTTP, IMF, SMB, and TFTP. Finally, the Expert Information dialog synthesizes protocol anomalies, errors, warnings, and general conversation notes categorized cleanly by severity level.

Guided Walkthrough: Searching, Carving, and Object Extraction

To locate artist information, press Ctrl+F to open the Find Packet bar. Set the search target to Packet details, type String, and query r4w. Clicking Find jumps to frame 33790, highlighting the target artist string.

To locate embedded analyst instructions, press Ctrl+G, jump to packet 12, right-click the packet, and select Packet Comment… (or press Ctrl+Alt+C).

The comment window instructs us to inspect packet 39765, right-click the JPEG File Interchange Format payload section inside the Packet Details pane, and export the packet bytes.

Navigating to packet 39765 via Ctrl+G, right-click the JPEG File Interchange Format layer in the details pane and click Export Packet Bytes….

Save the exported raw byte payload to your home directory as task3-q2.

Opening a terminal, run md5sum task3-q2 to calculate the MD5 digest of the carved JPEG image.

To reconstruct transmitted web files, navigate to File -> Export Objects -> HTTP….

In the HTTP object list window, sort by Content Type to group plain text files. Select note.txt (packet 4267) and click Save.

Confirm the file name as note.txt and save it to your working folder.

Display the contents in your terminal using cat note.txt. The output renders an ASCII art banner containing the target text flag.

To view automated protocol diagnostics and warning statistics across the capture file, navigate to Analyze -> Expert Information.

In the Expert Information window, locate the Warning section. Locate the summary entry stating "Illegal characters found in header name" under the HTTP protocol, which lists a total occurrence count.

Questions and Answers

Use the "Exercise.pcapng" file to answer the questions. Search the "r4w" string in packet details. What is the name of artist 1?

Answer:

r4w8173

r4w8173

Go to packet 12 and read the packet comments. What is the answer? Note: use md5sum terminal command to get MD5 hash

Answer:

911cd574a42865a956ccde2d04495ebf

911cd574a42865a956ccde2d04495ebf

There is a ".txt" file inside the capture file. Find the file and read it; what is the alien's name?

Answer:

PACKETMASTER

PACKETMASTER

Look at the expert info section. What is the number of warnings?

Answer:

1636

1636

Task 5: Packet Filtering

Filtering packets allows analysts to isolate pertinent protocol traffic from background noise in large trace files. Wireshark supports display filters that can be applied dynamically through the GUI or manually typed into the filter bar.

Applying a display filter directly from the packet details pane provides a quick way to focus on specific protocols or fields. By selecting a field such as Hypertext Transfer Protocol and using the context menu, analysts can instantly isolate all corresponding web traffic across the capture. Furthermore, reconstructed application-layer conversations can be analyzed in full using Wireshark's stream-following feature, which collates raw ASCII or hexadecimal payloads into a continuous view.

Guided Walkthrough: Dynamic Filtering and Stream Following

To filter specifically for HTTP traffic, expand the packet details pane on a web request, right-click Hypertext Transfer Protocol, and select Apply as Filter -> Selected.

Wireshark applies the http filter in the toolbar. Examining the status bar at the bottom right reveals the total number of displayed packets matching the query (1089). Examining the filtered list, packet 4 represents the very first HTTP request in the capture file.

To reconstruct the full web interaction, select packet 33790, right-click the Hypertext Transfer Protocol layer, and choose Follow -> HTTP Stream (or press Ctrl+Alt+Shift+H).

Inside the stream viewer window, enter artist= in the Find input box and click Find Next. Stepping through the matches reveals three artist parameters (artist=1, artist=2, and artist=3), confirming the number of artists listed on the webpage.

Continuing through the stream content with the search query artist=, locate the entry for the product titled Trees (product.php?pic=7). The HTML payload indicates it was painted by artist ID 2.

Questions and Answers

Use the "Exercise.pcapng" file to answer the questions. Go to packet number 4. Right-click on the "Hypertext Transfer Protocol" and apply it as a filter. Now, look at the filter pane. What is the filter query?

Answer:

http

http

What is the number of displayed packets?

Answer:

1089

1089

Go to packet number 33790, follow the HTTP stream, and look carefully at the responses. Looking at the web server's response, what is the total number of artists?

Answer:

3

3

What is the name of the second artist?

Answer:

Blad3

Blad3

Summary & Key Takeaways

Wireshark is an indispensable utility for network forensic analysis, incident response, and security auditing. Throughout this guide, we explored fundamental techniques required to analyze large packet captures efficiently from mastering basic GUI components and custom column configurations to leveraging advanced packet navigation and filtering features.

By applying targeted display filters, carving embedded objects directly from protocol streams, and utilizing diagnostic views like Expert Information, analysts can quickly cut through network noise to reconstruct attacker actions, locate flags, and extract critical evidence.

Key lessons:

• Tailor Your Workspace: Customizing the Packet List pane with custom columns (such as Hostnames or Stream IDs) significantly speeds up triage and context switching during investigation.
• Navigate with Precision: Keyboard shortcuts like Ctrl+F (Find Packet), Ctrl+G (Go to Packet), and Ctrl+Alt+Shift+H (Follow Stream) streamline searching across thousands of frames.
• Leverage Diagnostic Views: Automated features like Expert Information highlight protocol anomalies, errors, and warnings instantly without requiring manual rule construction.
• Extract Evidence directly: Embedded files, payload bytes, and HTTP objects can be easily carved out directly from the GUI for offline analysis, hash calculation, or malware inspection.