Wireshark is a Unix or Windows packet capture and analysis tool. Unlike tcpdump or tools such as RawCap, Wireshark is a GUI-based tool and has a number of not only packet capture, but also analysis features. As a result, Wireshark may be difficult to deploy rapidly during an incident as the program has to be installed. Furthermore, the tool is only supported on Windows or macOS. To install Wireshark on a Linux system requires a bit more effort. The one distinct advantage that Wireshark has over command-line options is that incident response analysts can perform a detailed inspection of the traffic as it is being captured. Wireshark can be run on the system itself or on a USB drive. Once installed, it has to be run as an administrator. To perform a packet capture with Wireshark, the following process is used:
- The first step is to select an interface that Wireshark will...
