Reading network captures

A capture file (.pcap) is a recording of network traffic. Wireshark opens it.

First steps

• Use the filter bar: http shows web traffic, ip.addr == 10.0.0.5 shows one machine
• Right-click a packet and choose Follow, then TCP Stream, to read a whole conversation as text
• Look at the Statistics menu for a summary of who talked to whom

Try it

Open any capture you have, filter for http and follow one stream. Note the request, the response and anything that looks like a password or a hidden message.