## Wireshark Essentials

Wireshark is the microscope for packets.

### 1. Capture Filters vs. Display Filters
*   **Capture Filters (BPF)**: Set *before* you record. Discards packets.
    *   `host 192.168.1.1` -> Only save packets involving this IP.
    *   **Pro**: saves disk space. **Con**: If you didn't capture it, you can't see it later.
*   **Display Filters**: Set *after* recording. Just hides packets from view.
    *   `ip.addr == 192.168.1.1`
    *   **Pro**: Flexible. Non-destructive.

### 2. Essential Display Filters
*   `http.request.method == "POST"`: Show me data uploads.
*   `tls.handshake.type == 1`: Show me HTTPS Client Hellos (domain names).
*   `dns.flags.response == 0`: Show me DNS queries.
*   `tcp.flags.syn == 1 and tcp.flags.ack == 0`: Show me connection attempts.

### 3. Follow TCP Stream
Right-click a packet -> "Follow TCP Stream".
*   Wireshark reassembles the conversation.
*   Instead of seeing 50 packets, you see the reconstructed text:
    *   `GET /passwords.txt HTTP/1.1`
    *   `Host: evil.com`
    *   `...`

### 4. Export Objects
File -> Export Objects -> HTTP.
*   Wireshark can extract files downloaded in the traffic.
*   "Oh, the user downloaded `virus.exe`? I can save that file from the PCAP to my desktop and hash it."