Investigate suspicious traffic with Wireshark.
What it does
Investigates network traffic with Wireshark and tshark to identify suspicious activity, diagnose protocol problems, and extract evidence.
When to use it
Use for suspected network intrusions, network performance problems, malware communications, firewall or IDS validation, and extracting evidence from captured sessions.
How to use it
Give it a network traffic investigation; it captures or analyzes packets and exports evidence, summaries, and analysis files.
Latest review
What you need · 3
Requires Wireshark 4.0 or later.
Requires the tshark command-line utility to be installed.
Access · 2
This skill
the monitored network segment
Read
Captures traffic on your network
tshark
Execute
Starts a live packet capture