> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/ollivanders/wireshark.md).

# Wireshark

| Task                                                  | Wireshark Usage                                                                                                                                                                                                                                                                                                                                                                                   |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Find the URL with a 200 OK Response**               | <p><strong>Apply HTTP filter</strong>: <code>http.response.code == 200.</code></p><p></p><p>Look at the <strong>"Host"</strong> and <strong>"Request URI"</strong> fields in the <strong>HTTP</strong> packets to determine the full URL accessed.=</p>                                                                                                                                           |
| **Find the IP and MAC of an Infected Windows Client** | <p><strong>Find the victim’s IP</strong> by filtering DHCP traffic:</p><ul><li><code>dhcp</code> or <code>bootp</code></li><li>Look for the <strong>Assigned IP address</strong> in the <strong>DHCP ACK</strong> packet.</li></ul><p><strong>Find the MAC address</strong>:</p><ul><li>Filter using <code>arp</code></li><li>Identify the MAC address associated with the victim’s IP.</li></ul> |
| **Find the Victim’s Hostname from NetBIOS**           | <p>Use the Wireshark filter:</p><ul><li><code>nbns</code> (NetBIOS Name Service)</li><li><code>nbns && ip.src == \[Victim IP]</code> to narrow results</li></ul><p>Look at <strong>Name Query Response</strong> packets to find the <strong>hostname</strong>.</p>                                                                                                                                |
| **Identify the Infected User Who Ran a file**         | Change the filter to Packet Bytes and Strings and then type the string (file name) to find the packets that are dealing with it.                                                                                                                                                                                                                                                                  |
| **Detecting PowerShell Traffic via User-Agent**       | Change the filter to Packet Details and Strings and then type the string (user-agent name) to find the packets that are dealing with it.                                                                                                                                                                                                                                                          |