Packet Sniffing Lab - Made easy.

 Wireshark

Wireshark is one of the most powerful, widely used, and respected network protocol analyzers in the world. It’s a free, open-source tool that lets you capture, inspect, and analyze data packets as they move through a network in real time kind of like putting a microscope on the traffic flowing through your computer or your entire network.

When data travels over a network, it doesn’t move as one big chunk it’s split into small packets. Each packet contains bits of data (like parts of an email, a file, or a web request) and metadata (like source and destination IP addresses, protocols used, etc.).

Wireshark lets you capture these packets and view their contents in an extremely detailed and structured way.
You can see:

• The source and destination of every packet

• Which protocol it used (HTTP, TCP, UDP, ARP, DNS, etc.)

• The exact data payload being transferred

• The timing of each packet (latency, retransmissions, etc.)

• And even reconstruct entire conversations (like following a TCP stream or viewing full HTTP requests and responses)

Wireshark uses a packet capture library (like libpcap on Linux or WinPcap/Npcap on Windows) to intercept traffic from your network interface card (NIC).
Once it captures those packets, it:

1. Decodes them according to known protocol structures (e.g., Ethernet → IP → TCP → HTTP).

2. Displays them in a human-readable form.

3. Allows filtering, searching, and color-coding based on protocol or traffic type.

You can view live captures or analyze previously saved captures (.pcap files). These files are the standard format for sharing and analyzing network data.

Wireshark in Cybersecurity

In security operations and ethical hacking, Wireshark is invaluable:

• You can spot malicious packets like ARP spoofing attempts, SYN floods, DNS exfiltration, or beaconing from infected hosts.

• In incident response, it helps determine how a breach occurred, what data was exfiltrated, or what command-and-control (C2) traffic looks like.

• During penetration testing, it can confirm if your payloads or attacks are reaching the target correctly or being blocked by a firewall.

Demo

As always, if we don't have the tool installed, we will need to get it.

You might receive a window asking you if you would like to install Dumpcap, which is a command-line packet capture tool that comes bundled with Wireshark. Think of it as the engine under the hood of Wireshark. it’s the actual program that performs packet capturing while Wireshark handles the display, decoding, and analysis.

and It's used to create a wireshark group on your host so other users, that are not superusers, be able to capture traffic on the network. 

For me i am okay with running wireshark with root privilege so i am going to click no.

We are going to make use of the hackeme lab, where we run it using docker. We will also need to access it on the loopback address simply because the other network interfaces would be too chaotic with so many traffic being generated.

On the login portal, after running packet capture on the loopback, we inserted dummy data to make a login post request. On the Wireshark window we are able to catch it and follow up through the http stream. The wireshark here is smart enough to grab all the packets generated and put them into one window to show us a single timeline.

After looking into the http stream and choosing a host -> target traffic for the sake of cleaning up the output. We can see the username value with the password that we have put.