Sniffing & Spoofing

wireshark

wireshark is the packet analyzer everyone eventually learns. It captures traffic off an interface and shows it to you in exhaustive detail — every packet, every field of every protocol, decoded and color-coded — with a filter language powerful enough to isolate exactly the conversation you care about out of millions of frames. It’s how you confirm what’s really happening on a network: unencrypted credentials, malformed packets, a protocol misbehaving, the exact bytes of an exchange you’re trying to understand.

Official-repo package; Security → Sniffing & Spoofing → wireshark. Wireshark is graphical and launches into its own window; it also ships tshark, the terminal version, for headless capture and scripting. Capturing needs privileges — Wireshark uses a helper (dumpcap) so you don’t run the whole GUI as root.

The help it prints

Wireshark 4.7.2
Interactively dump and analyze network traffic.
See https://www.wireshark.org for more information.

Usage: wireshark [options] ... [ <infile> ]

Capture interface:
  -i <interface>, --interface <interface>
                           name or idx of interface (def: first non-loopback)
  -f <capture filter>      packet filter in libpcap filter syntax
  -s <snaplen>, --snapshot-length <snaplen>
                           packet snapshot length (def: appropriate maximum)
  -p, --no-promiscuous-mode
                           don't capture in promiscuous mode
  -I, --monitor-mode       capture in monitor mode, if available
  -B <buffer size>, --buffer-size <buffer size>
                           size of kernel buffer in MiB (def: 2MiB)
  -y <link type>, --linktype <link type>
                           link layer type (def: first appropriate)
  --time-stamp-type <type> timestamp method for interface
  -D, --list-interfaces    print list of interfaces and exit
  -L, --list-data-link-types
                           print list of link-layer types of iface and exit
  --list-time-stamp-types  print list of timestamp types for iface and exit

Capture display:
  -k                       start capturing immediately (def: do nothing)
  -S                       update display when new items are captured
  -l                       turn on automatic scrolling while -S is in use
  --update-interval        interval between updates with new items, in milliseconds (def: 100ms)
Capture stop conditions:
  -c <item count>          stop after n items (def: infinite)
  -a <autostop cond.> ..., --autostop <autostop cond.> ...
                           duration:NUM - stop after NUM seconds
                           filesize:NUM - stop this file after NUM KB
                              files:NUM - stop after NUM files
                            events:NUM - stop after NUM events
Capture output:
  -b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
                           duration:NUM - switch to next file after NUM secs
                           filesize:NUM - switch to next file after NUM KB
                              files:NUM - ringbuffer: replace after NUM files
                            packets:NUM - switch to next file after NUM packets
                           interval:NUM - switch to next file when the time is
                                          an exact multiple of NUM secs
Input file:
  -r <infile>, --read-file <infile>
                           set the filename to read from (no pipes or stdin!)

Processing:
  -R <read filter>, --read-filter <read filter>
                           filter in display filter (wireshark-filter(4)) syntax
  -n                       disable all name resolutions (def: all enabled)
  -N <name resolve flags>  enable specific name resolution(s): "mtndsNvg"
  -d <layer_type>==<selector>,<decode_as_protocol> ...
                           "Decode As", see the man page for details
                           Example: tcp.port==8888,http
  --enable-protocol <proto_name>
                           enable dissection of proto_name
  --disable-protocol <proto_name>
                           disable dissection of proto_name
  --only-protocols <protocols>
                           Only enable dissection of these protocols, comma
                           separated. Disable everything else
  --disable-all-protocols
                           Disable dissection of all protocols
  --enable-heuristic <short_name>
                           enable dissection of heuristic protocol
  --disable-heuristic <short_name>
                           disable dissection of heuristic protocol

User interface:
  -C <config profile>      start with specified configuration profile
  -H                       hide the capture info dialog during capture
  -Y <display filter>, --display-filter <display filter>
                           start with the given display filter
  -g <item number>         go to specified item number after "-r"
  -J <jump filter>         jump to the first item matching the display
                           filter
  -j                       search backwards for a matching item after "-J"
  -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N]
                           format of time stamps (def: r: rel. to first)
  -u s|hms                 output format of seconds (def: s: seconds)
  -X <key>:<value>         eXtension options, see man page for details
  -z <statistics>          show various statistics, see man page for details

Output:
  -w <outfile|->           set the output filename (or '-' for stdout)
  -F <capture type>        set the output file type; default is pcapng.
                           an empty "-F" option will list the file types.
  --capture-comment <comment>
                           add a capture file comment, if supported
  --temp-dir <directory>   write temporary files to this directory
                           (default: /tmp)

Diagnostic output:
  --log-level <level>       sets the active log level ("critical", "warning", etc.)
  --log-fatal <level>       sets level to abort the program ("critical" or "warning")
  --log-fatal-count <count> sets the number of fatal errors before aborting the program
  --log-domains <[!]list>   comma-separated list of the active log domains
  --log-fatal-domains <list>
                            list of domains that cause the program to abort
  --log-debug <[!]list>     list of domains with "debug" level
  --log-noisy <[!]list>     list of domains with "noisy" level
  --log-file <path>         file to output messages to (in addition to stderr)

Miscellaneous:
  -h, --help               display this help and exit
  -v, --version            display version info and exit
  -P <key>:<path>          persconf:path - personal configuration files
                           persdata:path - personal data files
  -o <name>:<value> ...    override preference or recent setting
  -K <keytab>              keytab file to use for kerberos decryption
  --display <X display>    X display to use
  --fullscreen             start Wireshark in full screen

Using it

1. Pick an interface from the start screen — the little sparkline shows which ones have traffic.
2. Apply a display filter to cut the noise: http, ip.addr == 10.0.0.5, tcp.port == 443, dns, and so on. This filter language is the heart of Wireshark; learning it is most of the skill.
3. Follow a stream — right-click a packet and “Follow → TCP Stream” to reassemble a whole conversation into readable form.
4. Dig into fields in the detail pane; every protocol layer expands to its individual fields with their raw bytes highlighted.

tshark examples

# Capture 100 packets on an interface to a file
tshark -i wlan0 -c 100 -w capture.pcap

# Read a capture and filter for HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# Live capture, only DNS queries
tshark -i eth0 -Y "dns.flags.response == 0"