Master Wireshark: Advanced Packet Filtering, Timing, and Analysis Techniques

Wireshark provides powerful packet filtering and analysis capabilities. This guide demonstrates how to filter packets by IP address, protocol, and port; adjust time display formats; view and modify TCP sequence numbers; save filtered captures; perform packet count statistics; decode logs; trace TCP streams; and identify device manufacturers via MAC addresses.

1. Packet Filtering

Use expressions such as ip.addr==x.x.x.x to filter by IP, add tcp for protocol, or http and tcp.port==80 for specific traffic. You can also filter by source and destination addresses ( ip.src==... and ip.dst==...) and by TCP sequence numbers to locate packet loss.

2. Adjusting Time Display Format

Some captured packets show timestamps in an inconvenient format. Change the display via View → Time Display Format .

Before adjustment:

After adjustment:

3. Confirming Packet Order

When source and destination IPs, ports, and MAC addresses are identical, use TCP sequence numbers to order packets and detect loss.

Switch from relative to absolute sequence numbers via

Edit → Preferences → Protocols → TCP → Relative sequence numbers

and apply the shown parameters.

Example with TCP options removed:

Final result:

4. Saving Filtered Packets

After filtering large captures, export the relevant packets for later analysis.

5. Packet Count Statistics

During flood attacks, count packets to identify the most frequent traffic.

Statistics → Conversations

6. Decoding Packets

When logs mix IPS and AV data, decode the capture to separate them.

Before decoding:

Decoding operation:

After decoding:

7. TCP Stream Tracing

Extract the full TCP interaction to simplify analysis.

8. Identifying Device Manufacturer via MAC

When locating wireless interference sources, use the MAC address (e.g., A4-4E-31-30-0B-E0) and Wireshark's manuf file to find the vendor.