// what it is
Description
Dissects hundreds of protocols, color-codes anomalies, follows streams, decrypts TLS with the right keys, and writes a damning report when something on the wire isn't what it should be. The first network-forensics tool every analyst learns.
// use cases
What people use it for
- Deep-dive PCAP analysis
- Live capture during an active incident
- Decoding obscure protocols (Modbus, BACnet, SCTP, ...)
// commands
The commands you'll type
Capture filtered TLS handshakes
$ wireshark -k -i any -Y 'tls.handshake.type==1'Convert pcap to ASCII follow
$ tshark -r capture.pcap -q -z follow,tcp,ascii,0