Wireshark

Wireshark is a powerful open-source network protocol analyzer used for capturing, inspecting, and analyzing network traffic in real time.

Commands

Capture FTP traffic on interface en0 and save to packet_capture.pcap

sudo tshark -i en0 -f "tcp port 21" -w packet_capture.pcap

Read and analyze a previously saved packet capture file

sudo tcpdump -i en0 icmp

Useful Links

• Wireshark Website (GitLab) - Official website for downloading Wireshark and accessing resources.
• Wireshark Wiki - Comprehensive resource for Wireshark users.
• Wireshark User Guide - Official user guide for Wireshark.
• TryHackMe Wireshark Room - An interactive learning room focused on Wireshark basics.
• PyShark - A Python wrapper for tshark, allowing for easy packet parsing and analysis in Python scripts.
• Termshark - A terminal UI for Wireshark using TShark.