# Wireshark Fundamentals

Wireshark is the world's foremost network protocol analyzer. It allows you to open PCAP files and view the captured network traffic at a microscopic level.

## The Three-Pane View
When you open a PCAP in Wireshark, the interface is split into three main panels:
1.  **Packet List (Top):** Shows a chronological list of every captured packet, with basic summary info (Source IP, Destination IP, Protocol, Length).
2.  **Packet Details (Middle):** Shows the selected packet broken down layer by layer, matching the OSI model (e.g., Ethernet frame -> IPv4 header -> TCP header -> HTTP payload).
3.  **Packet Bytes (Bottom):** Shows the raw hexadecimal and ASCII representation of exactly what the raw packet looks like in binary.

## Display Filters
PCAP files can contain millions of packets. To find evil, you must master Display Filters. They allow you to hide the noise and focus only on relevant traffic.

*   **Filter by IP:**
    *   `ip.addr == 192.168.1.50` (Shows packets where this IP is either the source OR destination)
    *   `ip.src == 10.0.0.5` (Shows packets originating from this IP)
*   **Filter by Protocol:**
    *   `http` (Shows only unencrypted web traffic)
    *   `dns` (Shows only DNS queries and responses)
*   **Filter by Port:**
    *   `tcp.port == 443` (Shows typical HTTPS traffic)
    *   `udp.port == 53` (Shows typical DNS traffic)
*   **Combining Filters (Boolean Logic):**
    *   `ip.src == 192.168.1.100 && tcp.port == 80` (Finds HTTP traffic leaving a specific host)
    *   `http.request.method == "POST"` (Finds data being uploaded/sent to a web server)

## "Follow TCP Stream"
This is arguably Wireshark's most powerful feature for analysts.

A single file download might span 500 individual packets. Trying to read the file chunk by chunk in the "Packet Bytes" pane is impossible. 

By right-clicking a packet and selecting **Follow -> TCP Stream**, Wireshark automatically reassembles all 500 packets in the correct order, strips away the networking headers, and displays the pure application data (the actual conversation) in a clean, readable text window.