Wireshark is the premier packet dissection and network troubleshooting application. It allows auditors to inspect raw frame contents to ensure sensitive protocols are encrypted.
1. Capture Interfaces
Select your active network interface (such as eth0 or wlan0) to start capturing packets in real-time. Wireshark parses binary packets into readable headers.
2. Useful Display Filters
- http: Shows only unencrypted HTTP protocol web traffic.
- dns: Isolates domain name lookup resolution frames.
- ip.addr == 192.168.1.50: Filter traffic involving a specific host IP address.
3. Analyzing Cleartext Protocols
If an application transmits passwords using unencrypted protocols (like FTP, Telnet, or simple HTTP), auditors can right-click any frame and select Follow TCP Stream to read the plain-text passwords.
Defensive Recommendation: Enforce strict TLS/HTTPS policies. Replace insecure protocols with encrypted alternatives (like SSH instead of Telnet, SFTP instead of FTP).