Wireshark Packet Capture Tool: Complete Guide

Previously, we have introduced the tools that are often used in the networking industry, and Wireshark packet capture tool, Wireshark is a visual tool for network troubleshooting, one of the most commonly used tools, and today we'll talk about it with Wireshark packet capture examples.

The troubleshooting order is: specify the target of the capture → select the grab position→ set up the capture parameters→ Start packet capture and reproduce the fault→stop capture→ use filter to simplify the flow→Message / Session depth analysis→output the evidence to confirm the conclusion.

Step 1: wireshark packet capture tool：identify the target for packet capture

Before Wireshark packet capture, we should lock in the fault scenario. The untargeted package capture will produce a large amount of radio traffic, background synchronization, and system heartbeat, and so on, which will increase the analysis cost, as shown in a Wireshark capture example. The common packet capture target categories are:

•  Business access class: web page loading slowly, software login failure, video buffering, disconnection of device communication;

•  Network communication class: Packet loss during ping, inability to communicate across network segments, and failure of DNS resolution.

• Performance anomaly class: TCP delay is high, frequent retransmission, and connection is forced to disconnect.

•  Security: illegal access, abnormal port scanning, message tamper.

Step 2: wireshark packet capture tool：select the capture location and the corresponding network card

The traffic path determines the Wireshark packet capture location. Different scenarios correspond to different network cards and packet capture nodes. 

2.1Client machine packet capture

Wired Internet: select the ethernet/ Ethernet network card;

Wifi wireless: select WLAN/Wi-Fi network card;

Local debugging 127.0.0.1 procedure: select the loopback loop card;

Virtual machine: select the corresponding virtual card (VMware/Docker adapter).

Determine whether the network card is effective: After selecting the network card, the interface will display the real-time packet volume. If there is any traffic, it is considered correct.

2.2 Middle device bypass packet capture (such as switch)

configuration switch port’s mirror image, and the volume of the business flow is copied to the port of the catch bag for Wireshark packet capture, which is suitable for the number of terminal, industrial network and monitoring system, as shown in the Wireshark capture example.

2.3 Server-side packet capture

On Linux servers, use tcpdump; on Windows servers, directly use Wireshark to capture the network card of the server.

Step 3: wireshark packet capture tool：configure the capture parameters to streamline the original flow

Open the cap-options to maximize optimization and reduce the volume of the capture package:

3.1 Capture the filter (Packet filtering before capture, BPF syntax, no writing of irrelevant packets) 

filter the radio and the unused traffic in advance, such as the ARP, PING, for example:

• Only capture the traffic from the target IP: host 192.168.1.50.

• Only capture traffic on port 8080: port 8080.

• Exclude broadcast packets: not broadcast.

3.2 Limit message length

For routine faults, only the message header needs to be reported. Set the capture size to 128 bytes, which significantly reduces the file size; for deep protocol parsing, the restrictions are removed.

3.3 Automatic stop rule

Set up the file size/grab length threshold, to avoid cache overflow and program breakdown.

3.4 Special scene: switch mirror grab can close the mixed mode, only grab the target business flow.

Step 4: Start packet capture to reproduce the fault

4.1Click the blue shark fin icon to start capturing;

4.2 Complete duplicate network exception operation (such as opening the carton page and connecting the industrial equipment to the ping server);

4.3 Immediately stop the grab (red square button) and avoid excess traffic.

Step 5: display filter to filter core message (after the package is analyzed)

The capture filter discards packets in advance during Wireshark packet capture, while the display filter only hides irrelevant packets on the interface, while the original data is completely retained. It is the most commonly used tool for troubleshooting in daily operations, as demonstrated in Wireshark packet capture examples.

5.1The basic general filtering grammar

5.2 Example of compound conditions

Select the IP login request:

Ip.src = 192.168.1.100 and http.request.uri contains login"

Step 6: Packet and Session Depth Analysis

After filtering the target traffic, Carry out two levels of analysis:

6.1 single package details panel

Hierarchical check: physical layer → Ethernet MAC → IP layer → TCP/UDP transport layer → Business application layer (HTTP/DNS/Industrial protocols), view latency, error codes, and returned content.

6.2 TCP Session Tracking (Core Troubleshooting Function)

Right click message → Trace TCP flow, fully display the entire connection transmission and reception interaction log, one click export session text, quickly locate login failures, interface errors, and no-response issues of instructions.

Step 7: extract key evidence

7.1 Completely save the captured packet file: the suffix is the pcapng, which can be repeatedly opened.

7.2 Export evidence: the abnormal message screenshot of the TCP session text and the flow sequence diagram;

7.3 Tag exception message: add comments to retransmission, RST, timeout message, and facilitate communication orientation.

Step 8: output standardization check conclusion

Fixed four-paragraph summary, easy to  collabarate with the R&D/equipment manufacturer:

8.1fault phenomenon: automatic operation and abnormal performance;

8.2 Packet capture point: client/switch mirror/server;

8.3Key message evidence: retransmission, RST, DNS resolution failure and round-trip delay;

8.4 Root cause judgment: Link packet loss, server no response, firewall intercept, device protocol is not compatible.

9.A rapid fault location method for high-frequency networks

9.1web page/business loading is slow

Filter tcp.analysis.retransmission, a large number of retransmission = link packets loss ; Check the TCP round-trip time, RTT continues to be too high = server latency/line congestion.

9.2 Equipment connection failed, instantaneous disconnection

Find the tcp.flags.reset==1, an RST packet has appeared: Firewall interception, server port not open, device protocol mismatch.

9.3 The domain name cannot be accessed, but the IP address can be reached

Filter dns to see if the DNS response message returns correctly or whether it is over time.

9.4Industrial switch/PLC communication interruption

Filter the industrial protocol message (Modbus/Profinet) to see the interval of the message, whether there is a timeout, a message check error.

9.5 Packet loss in Ping

Filter icmpl, compare the request package and the response package number, and the absence of a response indicates packet loss on the link.

10.The advantages of Rayin Technology

As a manufacturer of independent R&D of industrial communication equipment, Rayin technology can provide free technical evaluation service, help you match the function of the project, and avoiding the shortcomings of equipment functions. If you need a complete product plan and technical white paper, welcome to visit our website: www.szrayin.com.