domains / families / security / analyzing-network-traffic-with-wireshark

analyzing-network-traffic-with-wireshark

separate

'Captures and analyzes network packet data using Wireshark and tshark

When to use

• Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement
• Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures
• Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts
• Validating firewall and IDS rules by confirming what traffic is actually traversing network segments
• Extracting files, credentials, or indicators of compromise from captured network sessions

When not to use

• Capture traffic on networks without authorization
• Intercept private communications without legal authority
• Substitute for full-featured SIEM platforms in production monitoring

Skill page

Source