Wireshark Packet Analysis in Practice — Display Filters and Traffic Debugging

What is Wireshark?

Wireshark is a tool that captures network packets, decodes them layer by layer, and analyzes them visually. If tcpdump shines at quickly capturing and saving packets from the CLI, Wireshark is specialized in expanding captured traffic into a protocol tree in a GUI, narrowing it with powerful display filters, and reconstructing flows. In practice, a common workflow is to dump a .pcap on the server with tcpdump -w and then open it in Wireshark for analysis.

This guide avoids overlapping with tcpdump and focuses on Wireshark-specific features (display filters, Follow Stream, Expert Info, statistics) and its CLI sibling, tshark.

Capture Filters vs. Display Filters

This is the point beginners confuse most. The two filters differ completely in both syntax and when they apply.

Essential Display Filters

Display filters take the form protocol.field comparison value.

# /
tcp.port == 443
http.request
dns
tls.handshake.type == 1            # Client Hello

#
ip.addr == 192.168.0.10
ip.src == 10.0.0.5 && ip.dst == 10.0.0.9

# ( : && || ! )
tcp.port == 443 && http.request
http.response.code >= 400 # 4xx/5xx

Filters especially useful for TCP debugging:

tcp.flags.syn == 1 && tcp.flags.ack == 0 # SYN ( when)
tcp.flags.reset == 1 # RST ( quit)
tcp.analysis.retransmission # (/ after)
tcp.analysis.duplicate_ack # ACK
tcp.analysis.zero_window # 0
tcp.window_size < 1000 #

tcp.analysis.* are virtual fields Wireshark infers and attaches by looking at packet flow. They are a Wireshark-only strength that tcpdump does not have, and they let you spot retransmissions, delay, and congestion at a glance.

HTTP / application level:

http.host contains "example.com"
http.request.method == "POST"
frame contains "password" #

Follow TCP/HTTP Stream

This feature reconstructs the full conversation of a given connection. Right-click a packet → Follow → TCP Stream (or HTTP/TLS Stream), and that session’s requests and responses are merged and shown in time order.

• Client sends are shown in red, server responses in blue.
• For HTTP, headers and body appear as-is, which is immediately useful for API debugging.
• Applying Follow automatically sets the display filter tcp.stream eq N.

tcp.stream eq 3 # 3 when

You can jump quickly between connections by stream number.

Expert Information

The Analyze → Expert Information menu collects anomalies Wireshark auto-detects, grouped by severity.

When analyzing latency or disconnects, start with Expert Info Warnings to quickly narrow cause candidates.

Using the Statistics Menu

The Statistics menu summarizes the entire capture.

• Protocol Hierarchy: which protocols use how much bandwidth
• Conversations: traffic volume per host pair, sortable by bytes/packets
• IO Graph: throughput over time. Graph a specific filter (e.g. tcp.analysis.retransmission) to pinpoint when loss occurred
• Endpoints: per-host send/receive stats, map view

If the retransmission curve spikes at a particular time in the IO Graph, that is strong evidence of a network problem at that moment.

tshark — Wireshark’s CLI

On servers where you cannot use the GUI, use tshark, the CLI of the same engine. It uses the same display-filter syntax.

# list
tshark -D

# when + (-Y)
sudo tshark -i eth0 -Y "tcp.port == 443 && tcp.flags.syn == 1"

# (-f, BPF) file save
sudo tshark -i eth0 -f "tcp port 443" -w /tmp/https.pcap

# save pcap +
tshark -r /tmp/https.pcap -Y "http.request" \
       -T fields -e ip.src -e http.host -e http.request.uri

#
tshark -r /tmp/https.pcap -Y "tcp.analysis.retransmission" | wc -l

Here too, -f is the capture (BPF) filter and -Y is the display filter, mapping exactly to the GUI.

Decrypting TLS Traffic

HTTPS is encrypted so payloads are not visible, but if the client logs session keys you can decrypt.

# /curl settings
export SSLKEYLOGFILE=/tmp/sslkeys.log

Point Wireshark’s Preferences → Protocols → TLS → (Pre)-Master-Secret log filename at this file and you can see decrypted HTTP. (A server private key alone cannot decrypt modern TLS 1.3 ECDHE.)

Practical Debugging Flow

1. Capture on the server with tcpdump -i eth0 -w issue.pcap host <>
2. Open in Wireshark and scan for anomalous packets with tcp.analysis.flags
3. Right-click a problem packet → Follow TCP Stream to inspect the conversation
4. Check Expert Information for retransmissions / resets / Zero Window
5. Quantify timing and scale with Statistics → IO Graph

Summary

Wireshark’s core workflow is “capture broadly, narrow with display filters, and reconstruct the flow.” If tcpdump is the collection tool, Wireshark is the interpretation tool.