Kali Wireshark packet analysis cheat sheet
Use display filters to inspect DNS, TCP handshakes and one lab conversation.
Wireshark desktop on Kali Linux. Examples are display filters, not capture filters.
Updated · Kali Linux · 7 min read
| Display filter | What it does |
|---|---|
dns | Display decoded DNS traffic |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | Find initial TCP SYN packets |
ip.addr == 192.0.2.10 | Focus on one IPv4 endpoint |
tcp.stream eq 0 | Isolate a TCP conversation |
Walkthrough
Open a packet capture you are authorized to inspect using File → Open. Use an existing lab capture for this walkthrough; captures can contain credentials and personal data.
Step 1: Display decoded DNS traffic
dns
Enter dns in the display filter bar and apply it. Match query names, transaction IDs and responses. Encrypted DNS may not appear as ordinary decoded DNS packets.
Step 2: Find initial TCP SYN packets
tcp.flags.syn == 1 && tcp.flags.ack == 0
Look for the first step of a TCP handshake, then compare it with the reverse-direction response. Retransmissions alone do not establish whether a firewall or endpoint caused a failure.
Step 3: Focus on one IPv4 endpoint
ip.addr == 192.0.2.10
Replace the documentation address with the host in your capture. This matches either source or destination. A display filter hides unrelated packets without deleting them from the file.
Step 4: Isolate a TCP conversation
tcp.stream eq 0
Replace 0 with the stream index of the selected connection, or use Follow → TCP Stream. TLS payload remains encrypted unless you have appropriate decryption material; export only approved data.