Technology and tools
What is Wireshark?
A free tool for capturing and inspecting network packets in detail, used to analyse traffic protocol by protocol.
Wireshark is a free, open-source packet analyser. It captures traffic or opens existing capture files and decodes hundreds of protocols, letting an analyst inspect each packet, follow a TCP or HTTP stream, filter by fields and extract transferred files.
It is the standard tool for close-up traffic analysis: confirming what a piece of malware sent, debugging a detection, or teaching how protocols really behave. For large volumes, analysts often start with Zeek logs and open specific sessions in Wireshark.