Wireshark on Kali Linux: Packet Analysis for Penetration Testers

Wireshark is where theory meets reality. You can read about TCP handshakes and HTTP flows all day, but opening a live packet capture and watching actual bytes move changes how you think about networks. For penetration testers, Wireshark is both a recon tool and a post-exploitation one – capturing credentials on insecure protocols, revealing internal network topology, and exposing misconfigurations that automated scanners miss.

Setup on Kali

sudo usermod -aG wireshark $USER
newgrp wireshark
wireshark &

# Command-line alternative
tshark -D    # List interfaces
tshark -i eth0 -w /tmp/capture.pcap

Capture Filters vs Display Filters

Capture filters (BPF syntax) are applied during capture. Display filters (Wireshark’s own language) are applied after. They look different and behave differently.

# Capture filters (BPF - use in Capture Options dialog)
host 192.168.56.101
port 80
net 192.168.56.0/24
not port 22

# Display filters (Wireshark filter bar)
ip.addr == 192.168.56.101
tcp.port == 80
http
http.request.method == "POST"
dns
arp

Following TCP Streams

Follow TCP Stream reconstructs the full conversation between endpoints – this is how you spot credentials in cleartext over HTTP, FTP, or Telnet. Right-click on any packet → Follow → TCP Stream.

http.request or http.response
tcp.stream eq 5    # Filter by stream number

Finding Credentials in Traffic

# FTP credentials
ftp.request.command == "USER" or ftp.request.command == "PASS"

# HTTP Basic Auth (Base64 encoded)
http.authorization

# HTTP POST login forms
http.request.method == "POST" and http.request.uri contains "login"

# Decode Base64 credentials found in captures
echo "dXNlcjpwYXNzd29yZA==" | base64 -d
# user:password

DNS Enumeration

DNS traffic reveals internal hostnames, AD structure, and services – even ones you can’t reach directly.

dns.flags.response == 0    # All queries
dns.flags.response == 1    # All responses
dns.qry.name contains "internal"

ARP Analysis

arp               # All ARP traffic
arp.opcode == 2   # ARP replies only

If you see the gateway IP claimed by two different MAC addresses in rapid succession, someone is ARP spoofing – either an attacker or a misconfigured tool.

HTTP Traffic Analysis

http.request.method == "POST"
http.request.uri contains "admin"
http.response.code == 403
http.user_agent contains "python"

Exporting Objects

Wireshark can extract files transferred over HTTP, FTP, and SMB from a capture. File → Export Objects → HTTP recovers files, scripts, and data that moved across the network.

tshark: Command-Line Power

# Capture to file
tshark -i eth0 -w /tmp/capture.pcap

# Read and filter
tshark -r /tmp/capture.pcap -Y "http.request.method == POST"

# Extract specific fields
tshark -r /tmp/capture.pcap -Y "ftp" -T fields -e ftp.request.command -e ftp.request.arg

# Statistics - most common IPs
tshark -r /tmp/capture.pcap -q -z ip_hosts,tree

Decrypting TLS Traffic

If you have the server’s private key (lab environments, your own infrastructure), configure Wireshark: Edit → Preferences → Protocols → TLS → RSA Keys List.

For modern TLS with forward secrecy, use the SSLKEYLOGFILE approach instead:

export SSLKEYLOGFILE=/tmp/ssl_keys.log
firefox &
# Edit → Preferences → Protocols → TLS → Pre-Master-Secret log filename

Statistics and Conversations

The Statistics menu is underused by beginners. Key views: Conversations (all unique host pairs, sorted by bytes), Protocol Hierarchy (identify unexpected protocols), HTTP → Requests (all URIs hit), DNS (query breakdown).

Conclusion

Wireshark rewards time invested in learning its filters and features. The ability to open a packet capture and rapidly extract credentials, hostnames, and application behaviour is a significant force multiplier. Start by capturing your own traffic – the gap between what you think is happening and what’s actually in the packets is often surprising.

Only capture traffic on networks you own or have explicit authorisation to monitor. Packet capture without permission is illegal.