Dissecting Traffic in Wireshark
Follow a stream, filter the noise, and pull credentials out of cleartext protocols.
What you will learn
- -Apply display filters to isolate a conversation
- -Follow a TCP stream to reassemble a full exchange
- -Recover credentials sent over cleartext protocols
tcpdump shows you . Wireshark shows you conversations. It reassembles scattered packets into readable streams, colors them by , and lets you filter interactively. When you have a pcap full of someone else's traffic, this is where the come out.
Display filters, not capture filters
Wireshark has two filter languages and mixing them up trips up everyone. The
capture filter uses BPF (the host and port syntax you already know). The
display filter is different, richer, and applied after capture. It uses the
protocol.field form.
ip.addr == 10.10.14.5shows packets touching that .tcp.port == 21shows FTP traffic.httpshows only .http.request.method == "POST"shows only requests, where logins live.
Type the filter into the bar at the top and press enter. The list narrows instantly, and you can change it as often as you like without recapturing.
GET /api/users/1 HTTP/1.1 Host: target.example.com
HTTP/1.1 200 OKFollow the stream
A single login is spread across many packets: the handshake, the request, the response, the acks. Reading them one by one is painful. Instead, right-click any packet in the conversation and choose Follow, then Stream. Wireshark stitches every packet in that conversation back into one readable transcript, text in one color and text in another.
You do not need the GUI to reassemble a stream. tshark, Wireshark's terminal twin, does the same thing and runs fine over on a target.
$tshark -r capture.pcap -Y http$tshark -r capture.pcap -z follow,tcp,ascii,3$tshark -r capture.pcap -Y 'ftp.request.command == "PASS"'Where the credentials hide
Cleartext protocols put usernames and passwords on the wire in plain view. When you follow one of these streams, the creds are simply there to read:
- FTP sends
USER bobthenPASS hunter2as literal commands. - HTTP basic auth carries a
Authorization: Basicthat is only , not . Decode it and you have the password. - Telnet echoes the entire login character by character.
- HTTP POST login forms send the form fields, passwords included, in the .
That is a working pair, harvested from traffic, ready to spray at SSH or the web login. This is exactly why the next lesson exists: the fix is to stop sending in the clear.
People reuse passwords across services. A single credential pulled from a cleartext FTP session often unlocks SSH, a web panel, and a database. Always try recovered creds against every other service you found while scanning.
You have a pcap with an FTP login buried in thousands of packets. What is the fastest way to read the whole exchange?
Write the Wireshark display filter that shows only HTTP POST requests, where form logins are submitted.
Display filters use the protocol.field form. The request method field is http.request.method, and login forms use POST.