Seeing what is on the wire

Defenders need to see the actual traffic on a network to spot attacks. The main tool is Wireshark, which captures and decodes packets. tcpdump does the same from the command line.

What to learn:

• Capturing packets and reading a capture
• Filtering down to the traffic you care about
• Spotting suspicious patterns: odd ports, plaintext passwords, port scans

This is where networking theory becomes visible and real.

Resources

• Wireshark educational content
• Guru99 Wireshark tutorial
• tcpdump tutorial (Daniel Miessler)
• Wireshark for beginners (video series)

Practice

Install Wireshark, or watch the series first if you cannot. Write down one type of traffic you would filter for when hunting a problem, and why.