View -> Time display format -> UTC date and time of day Protocol Hierarchy I usually change them to UTC for my investigations. Unless you can read and interpret these, it’s best to change these timestamps to human-readable dates and times. Adjusting timezoneīy default, Wireshark will display timestamps in absolute time since the start of the capture. It is powerful, flexible and a great tool to have in your DFIR arsenal. Wireshark has become the industry-standard network capture analysis tool, and for good reason. Data byte rate suggests that the network was not under heavy load during the time. We therefore immediately see that this packet capture ran for a few minutes, with the first and last packet seen 5 minutes apart. Applications/Wireshark.app/Contents/MacOS/capinfos In my case (MacOS), capinfos was found here: It resides in the Wireshark directory, same as tshark and reordercap – the other CLI tools that ship with Wireshark. Grab a sample PCAP fileĬapinfos is a CLI tool that ships with Wireshark and can be useful to derive quick insights about the PCAP.

We will be using sample pcaps in this post.

How do we then swiftly perform a PCAP analysis that covers maximum ground? This post provides a quick summary of analysis that can be done by Wireshark and its accompanying CLI tool, tshark. However, PCAPs contain massive amounts of data that is difficult to parse and time is valuable, especially during live investigations. PCAPs can greatly aid an investigation after an incident has occurred.

View pcap wireshark linux command line