The Lazy Networker

Tag: wireshark

  • Introduction to Useful Wireshark Filters

    Photo by Valdemaras D. on Pexels.com

    Wireshark is a powerful network protocol analyzer that helps users capture and analyze network traffic. To make the most out of Wireshark, using the right filters is essential. Filters help narrow down the traffic to specific protocols, IP addresses, or ports, making it easier to analyze and troubleshoot network issues.

    Filter by IP Address: ip.src == x.x.x.x or ip.dst == x.x.x.x to filter by source or destination IP address.

    Filter by Port: tcp.port == 80 or udp.port == 53 to filter by specific TCP or UDP ports.

    Filter by Protocol: http or dns to filter by specific protocols like HTTP or DNS.

    Filter by TCP Flags: tcp.flags == 0x02 to filter by specific TCP flags, such as SYN or ACK.

    Filter by Packet Length: frame.len > 100 or frame.len < 100 to filter by packet length.

    Filter by Conversation: ip.src == x.x.x.x and ip.dst == y.y.y.y to filter by conversations between two specific IP addresses.

    Filter by HTTP Requests: http.request.method == GET or http.request.method == POST to filter by specific HTTP request methods.

    Filter by DNS Requests: dns.qry.type == A or dns.qry.type == AAAA to filter by specific DNS query types.

    Filter by TCP Resets: tcp.flags.reset == 1 to filter by TCP reset packets.

    Filter by Sequence Number: tcp.seq == 12345 to filter by specific TCP sequence numbers.

  • How to check network latency using Wireshark

    To test network latency using Wireshark, follow these steps to effectively capture and analyze packet data:Setting Up Wireshark

    Install Wireshark: Download and install the latest version of Wireshark from the official website.
    Select the Network Interface: Open Wireshark and choose the appropriate network interface to capture packets. This is typically your Ethernet or Wi-Fi connection.

    Capturing Packets
    Start Packet Capture:Click on the “Capture” menu and select “Start” or simply click the shark fin icon.
    Allow Wireshark to run for a sufficient duration to capture relevant traffic.
    Stop Packet Capture:Click on the red square button to stop capturing once you have enough data.

    Analyzing Latency
    Use TCP Stream Graphs:Go to “Statistics” in the menu.
    Select “TCP Stream Graph” and then choose “Round Trip Time” (RTT) graph.
    This graph will display the round-trip time for packets, allowing you to visualize latency over time1.

    Inspect Individual Packets: Click on a specific packet in the capture window.
    In the packet details pane, look for timestamps which indicate when packets were sent and received. You can calculate latency by subtracting these timestamps4.

    Filter for Specific Protocols: Use display filters (e.g., tcp, icmp) to isolate specific types of traffic that may be contributing to latency issues.


    Calculate Latency Using Timestamps: If you have access to both client and server captures, you can compare timestamps from both ends to measure latency more accurately by subtracting the client’s send time from the server’s receive time4.

    Additional Analysis
    Identify Potential Issues: Look for signs of congestion, such as packet loss or retransmissions, which can contribute to increased latency.
    Use other statistics tools within Wireshark, such as “IO Graphs,” to visualize overall network performance.
    By following these steps, you can effectively use Wireshark to measure and analyze network latency, helping you identify bottlenecks and optimize your network performance