Team practiceSep 25, 2026
You Only Need Wireshark Twice a Year. That’s the Problem.
Help occasional Wireshark users stay ready for incidents with worked packet cases, capture playbooks, evidence...
Wiresharkpacket analysisnetwork troubleshooting
PacketSafari Blog
Capture strategy, packet-investigation playbooks, and product-relevant analysis content.
Latest packet-analysis articles
Alert workflowSep 24, 2026
From Suricata Alert to Reviewed Packet Evidence: UI, CLI, and API
Verify Suricata alerts with PacketSafari using EVE JSON, the UI, CLI, or API. Review packet evidence, verifica...
Suricata alert verificationEVE JSONPCAP analysis
AI agent securitySep 14, 2026
“I Only Searched the Web.” The Packet Capture Tells Another Story.
Investigate AI agent network activity with packet captures, DNS, timing, and byte counts, while separating dir...
AI agentsprompt injectionpacket capture
Featured packet-analysis guides
Practical evergreen guides for capturing, sanitizing, and investigating packet evidence.
BlogMar 28, 2025
PacketSafari PCAP Sanitization
PacketSafari PCAP sanitization on upload: slicing mode keeps headers and removes payload data, with optional d...
BlogMar 27, 2025
How to Anonymize a PCAP
How to anonymize a PCAP with packet slicing or TraceWrangler: strip payloads, shrink files, and share captures...
BlogMar 26, 2025
Capture PCAPs without Wireshark
Capture network packets without installing Wireshark: pktmon on Windows, tcpdump on Linux and macOS, plus snap...
All articles
The full PacketSafari archive: every published PCAP analysis guide, Wireshark technique, and packet investigation playbook.
- You Only Need Wireshark Twice a Year. That’s the Problem.Help occasional Wireshark users stay ready for incidents with worked packet cases, capture playbooks, evidence-backed assistance, and clear escalation rules.
- From Suricata Alert to Reviewed Packet Evidence: UI, CLI, and APIVerify Suricata alerts with PacketSafari using EVE JSON, the UI, CLI, or API. Review packet evidence, verification status, history, and reports for handoff.
- “I Only Searched the Web.” The Packet Capture Tells Another Story.Investigate AI agent network activity with packet captures, DNS, timing, and byte counts, while separating direct evidence from hypotheses and attribution.
- TCP Retransmission Analysis: Prove the CauseAnalyze TCP retransmissions by validating byte ranges, ACK and SACK history, timing, capture quality, application impact, competing causes, and exact packets.
- TLS Analysis Tools in 2026: What Each Tool ProvesCompare TLS analysis tools for decryption, handshake evidence, metadata, fingerprints, continuous monitoring, packet forensics, and incident analysis.
- Do All Your Admins Need to Become Wireshark Experts?Calculate Wireshark training costs beyond course fees, account for practice and senior escalation, and evaluate packet investigation for occasional users.
- How to Analyze Large PCAP FilesAnalyze large PCAP files by inventorying first, narrowing with indexed facts, preserving context, tracking coverage, and verifying sparse packet evidence.
- Suricata Alert Verification with Packet EvidenceLearn how to verify Suricata alerts against PCAP evidence, distinguish rule matches from malicious intent, and handle false positives and missing context.
- Troubleshoot Slow Applications With Packet CapturesTroubleshoot slow applications with packet captures by separating DNS, TCP, TLS, service wait, transfer, loss, receiver limits, and capture artifacts.
- Network Forensics Tools for Security AnalystsCompare network forensics tools for packet capture, session search, metadata, IDS, artifact extraction, manual validation, investigation, and report handoff.
- How to Find Malicious Traffic in a PCAPFind malicious traffic in a PCAP by combining capture checks, IDS leads, DNS, TLS, HTTP, beaconing, lateral movement, exact packets, and honest coverage.
- When an AI Agent Moves a Machine, What Can the Network Prove?Learn what packet evidence can and cannot prove when an AI agent drives a physical system, from network-visible intent to device exchanges and uncertainty.
- Packet Evidence Verification: A Practical StandardLearn how to verify packet evidence with exact frames, filters, streams, timestamps, fields, coverage, alternatives, and an independently reviewable conclusion.
- How to Analyze a PCAP File: A Practical WorkflowLearn how to analyze a PCAP file with a repeatable workflow for capture quality, traffic inventory, filtering, timing, evidence, verification, and reporting.
- How to Anonymize a PCAP in 2026Anonymize a PCAP before cloud AI analysis with open-source anoncap: reduce identifier and payload exposure while preserving useful packet evidence for review.
- AI Attacks Demand Breach-Path EvidenceThe Hugging Face incident shows why AI-speed attacks demand packet-grounded breach-path evidence across identity, lateral movement, C2, and containment.
- Best Packet Analysis Tools in 2026: 12 ComparedCompare 12 packet analysis tools for enterprise capture, decoding, hunting, forensics, automation, and reporting, with honest strengths and tradeoffs.
- AI Agents for Packet Analysis: PCAP WorkflowLearn how an AI agent can investigate PCAP files with deterministic decoding, bounded packet tools, hypotheses, exact evidence, verification, and enterprise privacy controls.
- Can ChatGPT Analyze PCAP Files?ChatGPT can help interpret packet evidence, but reliable PCAP analysis needs deterministic decoding, bounded tool access, exact packet citations, privacy controls, and verification.
- VoIP over IPsec and ESP Packet AnalysisLearn how PacketSafari analyzes VoIP over IPsec and ESP using SPI, IKE, RTP, and RTCP evidence, plus authorized, capture-scoped ESP decryption workflows.
- Decoding Ethernet-in-L2TPv3Extract Ethernet frames from L2TPv3 UDP payloads, decode the encapsulated traffic, and teach Wireshark to dissect it automatically with a Lua plugin today.
- STP, TCP Loss, and VoIP NAT: Packet CorrelationLearn how to correlate STP topology changes with TCP loss and connect SIP, SDP, RTP, and STUN evidence when troubleshooting VoIP NAT path failures in practice.
- Disabling AI Assistance for PCAPsHow to disable AI assistance for PCAP analysis in PacketSafari, giving instructors and CTF creators full control over training and challenge captures.
- PCAP Prompt CompressionLearn how PacketSafari compresses PCAP data into LLM prompts, using size-based strategies to turn raw packets and metadata into compact AI context for review.
- PacketSafari PCAP SanitizationPacketSafari PCAP sanitization on upload: slicing mode keeps headers and removes payload data, with optional deep anonymization of IP and MAC addresses.
- How to Anonymize a PCAPHow to anonymize a PCAP with packet slicing or TraceWrangler: strip payloads, shrink files, and share captures safely without losing diagnostic value.
- Capture PCAPs without WiresharkCapture network packets without installing Wireshark: pktmon on Windows, tcpdump on Linux and macOS, plus snap-length tips and PCAP upload for analysis.
- How to Solve a PCAP CTFLearn how to search packet contents, identify common flag patterns, and solve a simple PCAP capture-the-flag challenge with PacketSafari, step by step.
- AI PCAP Analyzer Tools ComparedCompare Wireshark, tcpdump, PacketSafari, Cisco Meraki AI PCAP Analyzer, PcapAI, logcat.ai, Teleseer, and Allegro by workflow, evidence, scale, and privacy.
- How to Use VMware Distributed Switch Port MirroringHow to capture VMware VM traffic with vSphere Distributed Switch port mirroring, when local mirroring works, and when you need remote or encapsulated mirroring instead.
- How to Capture Traffic from VMware vSphere VMsHow to capture traffic from VMware vSphere virtual machines using port groups, promiscuous mode, and host-local visibility without relying on misleading guest-local captures.
- Introducing Packetsafari CopilotIntroducing PacketSafari Copilot, an AI assistant for PCAP analysis that helps you investigate trace files, explain packets, and speed up troubleshooting.
- Find SMBv1 using WiresharkHow to find legacy SMBv1 hosts with Wireshark and tcpdump: capture SMB Negotiate Protocol packets with slicing so long-term baselining stays lightweight.
- Ransomware Protection: Backup and DefenseRansomware attacks are a persistent and ever-evolving threat, with devastating consequences for affected organizations. With the ongoing increase in the frequency and sophistication of these attacks, it's now more important than ever to ensure your organization has robust ransomware protection measures in place. In this article, we'll delve deeper into the essential concepts and methods for effective ransomware defense and backup.
- NIS2 Directive: All You Need to KnowAre you tired of sifting through endless articles on the NIS2 Directive, trying to figure out what it is and how it impacts your organization? Look no further.
- Zero Trust: Building a More Secure IT EnvironmentAs cyber threats continue to evolve and grow in sophistication, traditional security approaches are no longer enough. Enter the zero trust approach, which is gaining traction as an effective way to protect organizations from cyber attacks.
- PacketSafari is looking for SponsorsLearn why PacketSafari sought sponsors, what it cost to operate the online PCAP analyzer, and how community support could sustain continued development.
- Filtering Insecure Communication in WiresharkIn today's digital age, network security has become increasingly important. One of the primary concerns for administrators and security professionals is insecure communication protocols, which can expose sensitive information and create vulnerabilities. In this article, we will discuss some of the most common insecure communication protocols, such as HTTP, FTP, DNS, NTP, and BGP, and how to use Wireshark to filter and analyze them effectively.
- GDPR Compliance: Everything You Need to KnowIf you operate within the European Union (EU) or process personal data of EU citizens, it’s vital that you understand the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018. GDPR compliance is mandatory, and failure to comply can result in significant fines.
- CTF PCAP Walkthrough: see-through.pcapng FlagAnalyze the see-through.pcapng capture-the-flag challenge with PacketSafari and Wireshark, using TCP filters and packet contents to find the hidden flag.
- PCAP Analysis: Tips and Tricks for Network TrafficPacket capture (PCAP) analysis is a crucial aspect of network traffic analysis and network security. By capturing and analyzing packets of data flowing across a network, analysts can gain insights into network performance, diagnose issues, and detect security threats.
- NIS2 Risk Assessments: Best PracticesIf you're tasked with conducting a risk assessment in compliance with the NIS2 Directive, you're not alone. Risk assessments are a critical part of NIS2 compliance, helping organizations identify potential cybersecurity risks and determine the steps needed to mitigate them.
- NIS2 and Protection Against Advanced MalwareAs our world becomes increasingly reliant on technology, the threat of damaging cyber attacks grows larger every day. Advanced malware is one of the most dangerous and costly types of cyber attack, causing billions in damages each year. This is why it's more important than ever to understand how NIS2 can help protect against these threats.
- IPv4 Header Explained: The Significance of IP IDsThe Internet Protocol version 4 (IPv4) is the foundation of internet communications, providing a set of rules for data transmission across networks. With billions of devices connected to the internet, understanding the intricacies of the IPv4 protocol is essential for network professionals and packet analysis experts. In this article, we will explore the importance of the IP Identifier (ID) for correlating packets at multiple capture points and delve into the IPv4 header, which contains critical information for routing and data reassembly.
- Multi-Factor Authentication for NIS2 ComplianceAs organizations work to comply with the NIS2 Directive, one security measure that should be top of mind is multi-factor authentication. This authentication method provides an additional layer of security beyond traditional username and password credentials, making it significantly more difficult for hackers to gain unauthorized access to your network.
- NIS2 and Proactive Network MonitoringPicture this: you're running a successful online business, and everything is going smoothly. Suddenly, security breaches start wreaking havoc on your company, and you're left wondering what could have been done to prevent them. Enter the NIS2 directive and its emphasis on regularly monitoring network and information systems for security breaches. In this article, we'll explore the critical role proactive network monitoring plays in NIS2 compliance and delve into real-world case studies to illustrate how you can stay ahead of the curve.
- How to Analyze PCAP Files Online: A Beginner's GuideAs data travels over a network, it's important to be able to capture and analyze it to identify potential security threats, diagnose network issues, and optimize performance. This is where PCAP files come in. PCAP (Packet Capture) files are a type of file format that record network traffic, allowing you to analyze the data to gain insights into network behavior and identify any issues or threats.
- Wireshark CTF Challenges: 5 Real-World Case StudiesCapture the Flag (CTF) competitions are a popular way for cybersecurity enthusiasts to test their skills and learn new techniques. In this article, we will explore 5 real-world Wireshark CTF challenges and share expert tips on how to tackle them.
- Online Wireshark Training by PacketSafariOnline Wireshark Training by the makers of the online PCAP analyzer PacketSafari is a comprehensive training program designed to teach individuals how to use Wireshark, the world’s most popular network protocol analyzer. This program is created by the developers of PacketSafari, the online PCAP analyzer that provides a web-based interface for viewing and analyzing captured packets. With this program, you can develop your network analysis skills and gain hands-on experience in real-world scenarios.
- NIS2 Directive: Incident Response PlansIn the wake of cyber attacks that have impacted major companies around the world, the importance of having a robust incident response plan cannot be overstated. Not only is a strong incident response plan vital for reducing the potential impact of a security breach, but it is also crucial for ensuring compliance with the NIS2 Directive.
- RTP Voice Stream Analysis in WiresharkReal-time Transport Protocol (RTP) is commonly used for transmitting voice and video data over IP networks, making it a crucial component of many VoIP and video conferencing applications. In this article, we will focus on how you can analyze RTP voice streams using Wireshark, identify common problems like packet loss and jitter, and understand the acceptable values for these parameters.
- Creative PCAP CTF Challenges: 5 WalkthroughsCapture the Flag (CTF) competitions and creative PCAP challenges are excellent ways to test and improve your packet analysis skills. In this article, we will walk through five unique case studies and provide expert insights to help you master these challenges.
- ARP Analysis in Wireshark: Real-World Case StudiesARP is a critical protocol in network communication, and it can often be the cause of network issues. In this article, we will explore real-world case studies of network issues caused by ARP, and how they can be investigated using packet analysis tools like PacketSafari and Wireshark.
- CDP, OSPF, RIP, BGP, EIGRP with WiresharkIn this article, we dive into troubleshooting cases using Wireshark for network protocols like CDP, OSPF, RIP, BGP, and EIGRP. We will provide real-world examples, expert knowledge, and useful Wireshark filters for each protocol.
- ICMP Errors: Destination Unreachable and MTU IssuesICMP (Internet Control Message Protocol) is an essential aspect of networking, as it allows network devices to communicate error messages, control information, and other network-related issues. In this article, we will demystify ICMP errors, focusing on destination unreachable, fragmentation needed, and MTU (Maximum Transmission Unit) problems. I will share my insights and knowledge on these topics, providing real-world case studies and examples to help you better understand ICMP errors.
- HTTP Packet Analysis: Wireshark vs Burp SuiteWhen it comes to HTTP traffic analysis, both Wireshark and intercepting proxies like Burp Suite offer valuable insights. This article will compare their features, limitations, and use cases to help you choose the right tool for your needs.
- PCAP Analysis for Zoom, Webex, and GoToTroubleshoot Zoom, Webex, and GoTo meeting quality with a PCAP workflow for media identification, packet loss, jitter, fallback transport, path changes, and user-impact correlation.
- TCP Segment Loss in Wireshark: Expert Tips and TricksTCP (Transmission Control Protocol) is a widely-used transport layer protocol that provides reliable, ordered, and error-checked delivery of data between applications. While TCP is designed to handle various network issues, such as congestion and packet loss, it's essential for network administrators and analysts to understand and troubleshoot these issues. One common problem is TCP segment loss. In this article, we'll dive into the causes of TCP segment loss, how to identify it in Wireshark, and share expert tips for troubleshooting.
- TryHackMe Wireshark Filters: Protocol FiltersThe Wireshark Filters room by Chris Greer on TryHackMe was designed for Wireshark. Learn how to solve its protocol filter tasks with PacketSafari online.
- Privileged Access Management for Remote WorkAre your PAM solutions as secure as you think? See how keystroke injection defeats clipboard and file-copy protections and enables lateral movement attacks.
- Wi-Fi Traffic Analysis in Wireshark: 5 CasesWi-Fi traffic analysis is a critical skill for network administrators and security professionals. By analyzing Wi-Fi traffic, you can gain insights into network performance, identify security vulnerabilities, and troubleshoot connectivity issues. Wireshark, a widely-used packet analysis tool, provides powerful features for capturing and analyzing Wi-Fi traffic. In this article, we'll explore five real-world case studies that demonstrate the value of using Wireshark for Wi-Fi traffic analysis.
- Windows Name Poisoning Attacks ExplainedHow LLMNR, NetBIOS, and mDNS name poisoning lets attackers intercept Windows name resolution and capture credentials, and how to spot it in Wireshark.
- How to decrypt TLS traffic in WiresharkDecrypt TLS 1.2 and TLS 1.3 traffic in Wireshark with an SSLKEYLOGFILE, understand when RSA private-key decryption works, and troubleshoot missing secrets or incomplete captures.
- Wireshark 4.0 Filters for Repeated LayersLearn how Wireshark 4.0 display filters handle repeated protocol layers, why the old syntax was ambiguous, and how to target the field occurrence you need.
- Wireshark has a new default layoutSee what changed in the Wireshark 4.0 default layout, why experienced analysts already used this arrangement, and how it improves daily packet inspection.
- HTTP/1 vs HTTP/2 vs HTTP/3: QUIC and MultiplexingAs the internet evolves, so do the protocols that enable communication between clients and servers. In this article, we explore HTTP/1, HTTP/2, HTTP/3, and QUIC, discussing their key differences, commonalities, and the concepts of pipelining and multiplexing.
- IEC 60870-5-104 and IEC 61850 Analysis with WiresharkAnalyze IEC 104, MMS, GOOSE, and Sampled Values traffic in Wireshark with protocol-appropriate capture points, filters, sequence checks, and operational context.
- FHRP Failover: Layer 2 and 3 Changes ExplainedHow HSRP, VRRP, and GLBP handle Layer 2 and Layer 3 changes during failover: virtual MAC ownership, gratuitous ARP, and active-active load distribution.
- DNS Protocols: DoH, DoT, DNSSEC, and DNSCurveThe Domain Name System (DNS) is a fundamental part of the internet's infrastructure, providing the essential service of translating human-readable domain names into IP addresses that computers can understand. Over time, various protocols and security measures have been developed to enhance DNS functionality and security. In this article, we'll dive into the details of DNS protocols like DNS over HTTPS (DoH), DNS over TLS (DoT), DNSSec, and DNSCurve, comparing their features, usage, and real-world case studies. We'll also explore how to analyze and troubleshoot DNS issues using packet analysis tools like Wireshark and PacketSafari.
- First Hop Redundancy Protocols in WiresharkFirst Hop Redundancy Protocols (FHRPs) play an essential role in maintaining network availability and resilience. There are several FHRPs, each with its unique characteristics and operational principles. In this article, we will discuss the key FHRPs, their impact on capturing trace files, and how to troubleshoot them using Wireshark.
- DNS Analysis in Wireshark: 3 Investigation PatternsUse Wireshark to diagnose unanswered DNS queries, slow resolution, suspicious answers, and possible DNS tunneling without confusing packet symptoms with proof.
- GDPR, Google Analytics and leaking hashesThe use of Google Analytics has been found to violate European Union privacy laws in France recently. This succeeds a similar ruling in Austria. The rulings found that Article 44 of GDPR is breached because personal data is transferred outside the EU to third countries that are not considered to have sufficient privacy protections. The U.S., where Google Analytics is hosted, fails the equivalence test on account of having surveillance laws that don't afford non-U.S. citizens basic protection of their personal data.
- STP Analysis with Wireshark: 3 Real-World Case StudiesThe Spanning Tree Protocol (STP) is a critical network protocol that prevents loops in Ethernet networks by creating a loop-free logical topology. As a network administrator or engineer, understanding and analyzing STP is essential for maintaining a healthy and efficient network. In this article, we'll introduce you to three real-world case studies that demonstrate the power of Wireshark, a leading packet analysis tool, in STP analysis.
- Analyzing NTP Traffic with WiresharkThe Network Time Protocol (NTP) is a critical service for maintaining accurate time synchronization across networks. Accurate time synchronization is essential for various applications, such as authentication, logging, and troubleshooting. In this article, we will discuss how to analyze NTP traffic using Wireshark, a popular packet analyzer, and explore three real-world case studies. Our PacketSafari online analyzer can also be used to analyze NTP traffic with ease.
- QoS Analysis with Wireshark: 3 Case StudiesQuality of Service (QoS) is crucial for managing and prioritizing network traffic, ensuring that critical applications and services receive the necessary resources. In this article, we'll dive into three case studies using Wireshark to analyze QoS at both Layer 2 (802.1Q) and Layer 3 (ToS/DSCP).
- Modern TCP Algorithms in Windows and LinuxExplore modern TCP algorithms in Windows 10, 11, and Linux, and learn how to tune them for optimal performance. We'll also discuss common problems in clients and servers and their solutions.
- Wireshark TCP Stream Graphs: A Practical GuideLearn how to read Wireshark TCP stream graphs for throughput, RTT, acknowledgments, SACK, receive-window limits, packet loss, reordering, and application stalls.
- TCP Spurious Retransmissions in WiresharkLearn what Wireshark's TCP Spurious Retransmission label actually means, how capture gaps can create false signals, and which ACK, SACK, timing, and sequence evidence proves the cause.
- Name Resolution Protocols and MITM MitigationIn this article, we will explore various network name resolution protocols such as NetBIOS, mDNS, LLMNR, and DNS, and discuss how to identify and mitigate man-in-the-middle (MITM) attacks using Wireshark.
- Packet Capture in the Cloud: Case StudiesAs more organizations migrate their services and applications to the cloud, understanding and troubleshooting network traffic becomes increasingly crucial. However, packet capture and analysis in the cloud present unique challenges compared to traditional on-premises networks. In this article, we will dive into these challenges, explore real-world examples, and provide expert insights on how to overcome them.
- VoIP Troubleshooting: SIP and RTP Case StudiesVoIP (Voice over IP) communication has become an integral part of modern telephony, offering greater flexibility and cost savings compared to traditional phone systems. As with any technology, VoIP networks rely on efficient and reliable connections, making troubleshooting an essential skill for network analysts. In this article, we will explore practical case studies using SIP (Session Initiation Protocol) and RTP (Real-time Transport Protocol) to enhance your VoIP troubleshooting expertise.
- Wireshark Bluetooth and USB Capture with NpcapUnderstanding and analyzing Bluetooth and USB traffic is critical in the modern era of connected devices. Learn how to capture traffic data with Wireshark, install and use the NPCAP driver correctly, and gain valuable insights from your data.
- SMBv1 vs SMBv2 vs SMBv3: Wireshark FiltersCompare SMBv1, SMBv2, and SMBv3, identify the negotiated SMB dialect in Wireshark, and verify signing, encryption, authentication, and legacy SMB risk from packet evidence.
- Packet Capture on iPhone and Android DevicesPacket capturing is an invaluable skill for network analysis and troubleshooting. With the increasing use of mobile devices, it has become more critical than ever to understand how to capture packets on iPhones and Androids. This comprehensive guide will walk you through the mechanisms available for packet capturing on mobile devices, and demonstrate how to analyze these captures using Wireshark.
- Multicast Video Traffic Analysis: 3 Case StudiesMulticast video traffic analysis is essential for ensuring the quality of video streaming services. With the ever-growing demand for high-quality video content, understanding how to analyze and troubleshoot multicast traffic is vital for network engineers and administrators. In this article, we will explore three real-world case studies that demonstrate how to use Wireshark and other packet analysis tools to identify and resolve common multicast video traffic issues.
- Kerberos Troubleshooting in Wireshark: 5 CasesKerberos is a critical authentication protocol in many enterprise environments, ensuring secure communication between clients and servers. However, when problems arise, it can be challenging to identify the exact issue. In this article, we'll explore five real-world case studies of advanced troubleshooting of Kerberos problems with Wireshark, the popular network protocol analyzer.
- Troubleshooting Layer 2 Network ProblemsLayer 2 problems are common in network environments and can cause significant performance issues or even complete network outages. Troubleshooting these problems can be challenging, especially in complex environments like hospitals where equipment is frequently sanitized and older devices require specific port configurations. In this article, we'll discuss the most frequent Layer 2 issues and provide expert tips for solving them using Wireshark, the world's foremost network protocol analyzer.
- Link Aggregation: LAG, LACP, MLAG and StackingLink aggregation is a powerful technique that can significantly improve your network's performance, redundancy, and resilience. This article will provide a high-level overview of various link aggregation technologies, including LAG, LACP, Etherchannel, MLAG, Stacking, and First Hop Redundancy Protocols (FHRP) like HSRP.
Move from reading about packet investigations to running them
Use the product pages when you want the software story instead of just the content channel.