# Wireshark

> Use for packet-level protocol review, detection visibility checks, and troubleshooting during authorized pentests. Trigger on validating network observations, confirming cleartext exposure, and comparing attacker activity to available telemetry.

- Skill: `timsonner/wireshark` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/wireshark`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/wireshark/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/wireshark

---


# Wireshark

## Purpose

Use this skill when packet-level evidence is needed to understand protocol behavior or defensive visibility.

## Phase Fit

- Primary: Detection and Response Assessment
- Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration

## Use When

- Need to confirm protocol behavior, cleartext exposure, or unexpected service interactions.
- Need to compare observed traffic against what defenders can see and alert on.
- Need to troubleshoot whether a validation path is behaving as expected.

## Avoid When

- Packet capture is not approved.
- The capture would collect unnecessary sensitive data or out-of-scope traffic.

## Inputs

- Approved capture location and duration
- Relevant hosts, protocols, and time window
- Handling rules for sensitive capture data

## Procedure

1. Capture from the approved segment only.
2. Filter quickly to the traffic that matches the current hypothesis.
3. Identify cleartext data, protocol anomalies, or missing segmentation indicators.
4. Compare packet observations to logs, alerts, and expected telemetry.
5. Summarize only the evidence needed for reporting and control improvement.

## Command Syntax

Replace sample interfaces and targets with approved in-scope values.

```bash
# Start Wireshark GUI on an interface
wireshark -i eth0 -k

# CLI capture (tshark) to file
tshark -i eth0 -w contoso-capture.pcap

# Capture filtered to a host and port
tshark -i eth0 -f "host 10.10.10.100 and tcp port 443" -w contoso-filtered.pcap

# Capture NTLM auth traffic
tshark -i eth0 -f "tcp port 445" -w contoso-smb.pcap

# Read a pcap and filter for HTTP POST
tshark -r contoso-capture.pcap -Y "http.request.method == POST"

# Extract HTTP host and URI fields
tshark -r contoso-capture.pcap -Y "http" -T fields -e http.host -e http.request.uri

# Capture LLMNR/NBT-NS traffic for poisoning evidence
tshark -i eth0 -f "udp port 5355 or udp port 137" -w contoso-llmnr.pcap
```

## Evidence to Capture

- Protocol-level observations tied to the tested activity
- Cleartext or weakly protected flows that create material risk
- Logging blind spots or telemetry mismatches

## Safety Boundaries

- Minimize capture scope and retention.
- Protect packet captures as sensitive evidence.