Wireshark & Network Security Complete Guide: From Packet Sniffing to Intrusion Detection — Security for Developers

Traditional Approach:
  Design → Develop → Test → [Security Test] → Deploy
  ← Cost increases exponentially when issues found late →

Shift-Left:
  [Security Design] → [Secure Coding] → [Security Testing] → [Security Monitoring]
  ← Early detection reduces cost →

brew install --cask wireshark

sudo apt update
sudo apt install wireshark
sudo usermod -aG wireshark $USER
# Log out and log back in

host 10.0.0.1
port 443
net 192.168.0.0/24
tcp and port 80
not arp

ip.addr == 10.0.0.1
tcp.port == 443
http.request.method == "GET"
dns.qry.name contains "google"

# TCP Stream example (HTTP request/response)
GET /api/users HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json
Set-Cookie: session=abc123; HttpOnly; Secure

[Response Body]

Source          Destination     Packets   Bytes
10.0.0.5        52.85.132.99    1,234     890KB
10.0.0.5        142.250.80.46   567       234KB
10.0.0.5        104.18.32.68    345       156KB

Ethernet (100%)
  ├── IPv4 (98.5%)
  │   ├── TCP (85.2%)
  │   │   ├── TLS (62.1%)
  │   │   ├── HTTP (15.3%)
  │   │   └── Other (7.8%)
  │   ├── UDP (12.8%)
  │   │   ├── DNS (8.2%)
  │   │   └── QUIC (4.6%)
  │   └── ICMP (0.5%)
  └── ARP (1.5%)

Profile examples:
  - Default: General analysis
  - Security: Security analysis (color rules, security columns)
  - Performance: Performance analysis (latency, retransmission columns)
  - DNS: DNS analysis dedicated

tcpdump [options] [BPF filter expression]

-i eth0        # Specify interface
-w output.pcap # Save to file
-r input.pcap  # Read from file
-c 100         # Capture only 100 packets
-n             # Disable DNS reverse lookup (faster)
-nn            # Also don't convert port numbers
-v / -vv / -vvv  # Increase verbosity
-X             # Hex + ASCII output
-A             # ASCII only output
-s 0           # Capture full packets (default: 262144 bytes)
-tttt          # Human-readable timestamp format

# 1. Capture on the server
ssh user@server 'sudo tcpdump -i eth0 -c 5000 -w /tmp/capture.pcap port 443'

# 2. Copy to local machine
scp user@server:/tmp/capture.pcap ./analysis/

# 3. Open with Wireshark
wireshark ./analysis/capture.pcap

# Method 1: SSH pipe
ssh user@server 'sudo tcpdump -i eth0 -w - port 443' | wireshark -k -i -

# Method 2: Using named pipe
mkfifo /tmp/remote_capture
wireshark -k -i /tmp/remote_capture &
ssh user@server 'sudo tcpdump -i eth0 -w - port 443' > /tmp/remote_capture

# Method 3: Time-limited capture
ssh user@server 'sudo timeout 60 tcpdump -i eth0 -w - port 80' | wireshark -k -i -

Step 1: SYN (Client → Server)
  Source: 10.0.0.5:54321
  Dest:   93.184.216.34:443
  Flags:  [SYN]
  Seq:    0 (ISN: Initial Sequence Number)
  Win:    65535
  Options: MSS=1460, SACK Permitted, Window Scale=6

Step 2: SYN-ACK (Server → Client)
  Source: 93.184.216.34:443
  Dest:   10.0.0.5:54321
  Flags:  [SYN, ACK]
  Seq:    0 (Server's ISN)
  Ack:    1 (Client ISN + 1)
  Win:    65535
  Options: MSS=1400, SACK Permitted, Window Scale=7

Step 3: ACK (Client → Server)
  Source: 10.0.0.5:54321
  Dest:   93.184.216.34:443
  Flags:  [ACK]
  Seq:    1
  Ack:    1
  Win:    65535

# HTTP Request Packet Detail
Frame 45: 342 bytes on wire
  Ethernet II: Src=aa:bb:cc:dd:ee:ff, Dst=11:22:33:44:55:66
  Internet Protocol Version 4: Src=10.0.0.5, Dst=93.184.216.34
  Transmission Control Protocol: Src Port=54321, Dst Port=80
  Hypertext Transfer Protocol:
    GET /api/v1/users?page=1 HTTP/1.1
    Host: api.example.com
    User-Agent: Mozilla/5.0 ...
    Accept: application/json
    Authorization: Bearer eyJhbGci...
    Cookie: session_id=abc123
    Connection: keep-alive

# HTTP Response Packet Detail
Frame 47: 1280 bytes on wire
  Hypertext Transfer Protocol:
    HTTP/1.1 200 OK
    Content-Type: application/json; charset=utf-8
    Content-Length: 956
    Set-Cookie: session_id=xyz789; HttpOnly; Secure; SameSite=Strict
    X-Request-Id: req_abc123
    Strict-Transport-Security: max-age=31536000
    X-Content-Type-Options: nosniff

# DNS Query
Domain Name System (query)
  Transaction ID: 0x1a2b
  Flags: 0x0100 Standard query
  Questions: 1
  Queries:
    api.example.com: type A, class IN

# DNS Response
Domain Name System (response)
  Transaction ID: 0x1a2b
  Flags: 0x8180 Standard query response, No error
  Questions: 1
  Answer RRs: 2
  Answers:
    api.example.com: type A, class IN, addr 93.184.216.34
      TTL: 300 (5 minutes)
    api.example.com: type A, class IN, addr 93.184.216.35
      TTL: 300 (5 minutes)

Step 1: Client Hello
  TLS Record Layer:
    Content Type: Handshake (22)
    Version: TLS 1.0 (compatibility)
  Handshake Protocol: Client Hello
    Version: TLS 1.2 (for compatibility)
    Random: [32 bytes]
    Session ID: [32 bytes]
    Cipher Suites (17 suites):
      TLS_AES_256_GCM_SHA384
      TLS_AES_128_GCM_SHA256
      TLS_CHACHA20_POLY1305_SHA256
    Extensions:
      server_name: api.example.com  (SNI)
      supported_versions: TLS 1.3
      key_share: x25519 [public key]
      signature_algorithms: ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256

Step 2: Server Hello + Certificate + Finished
  Handshake Protocol: Server Hello
    Cipher Suite: TLS_AES_256_GCM_SHA384
    Key Share: x25519 [server public key]
  [Encrypted Extensions]
  [Certificate]
  [Certificate Verify]
  [Finished]

Step 3: Client Finished (Encrypted)
  [Change Cipher Spec]
  [Finished]

# 1. Set environment variable (bash)
export SSLKEYLOGFILE="$HOME/.ssl-keys.log"

# 2. Launch Chrome or Firefox (they automatically recognize this variable)
# The browser writes TLS session keys to the file

# 3. Also works with curl
SSLKEYLOGFILE=$HOME/.ssl-keys.log curl https://api.example.com/health

Who has 10.0.0.1? Tell 10.0.0.5
  → 10.0.0.1 is at aa:bb:cc:dd:ee:ff

# Attacker impersonating the gateway (10.0.0.1)
10.0.0.1 is at [Attacker MAC: 11:22:33:44:55:66]  ← Abnormal!
10.0.0.1 is at [Real MAC: aa:bb:cc:dd:ee:ff]       ← Normal

# Two different MAC addresses for the same IP → ARP Spoofing!

arp.duplicate-address-detected
arp.duplicate-address-frame

#!/bin/bash
# ARP table monitoring
while true; do
    arp -a | sort > /tmp/arp_current.txt
    if [ -f /tmp/arp_previous.txt ]; then
        diff /tmp/arp_previous.txt /tmp/arp_current.txt
        if [ $? -ne 0 ]; then
            echo "[ALERT] ARP table changed at $(date)"
            diff /tmp/arp_previous.txt /tmp/arp_current.txt
        fi
    fi
    cp /tmp/arp_current.txt /tmp/arp_previous.txt
    sleep 10
done

Attacker → Target:22  [SYN]
Target:22 → Attacker  [SYN,ACK]  ← Port open
Attacker → Target:22  [RST]       ← Connection not completed

Attacker → Target:23  [SYN]
Target:23 → Attacker  [RST,ACK]  ← Port closed

# SYN scan detection (SYN without ACK)
tcp.flags.syn == 1 and tcp.flags.ack == 0

# Multiple SYN to various ports in short time
tcp.flags.syn == 1 and tcp.flags.ack == 0 and ip.src == 10.0.0.100

# Massive SYN packets from various source IPs simultaneously
# Wireshark filter
tcp.flags.syn == 1 and tcp.flags.ack == 0

# Count SYN packets with tcpdump
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' -c 10000 2>&1 | tail -1
# Result: "10000 packets captured" in seconds indicates SYN Flood

# Mass requests to the same URL
# Wireshark filter
http.request.uri == "/api/login"

# Check requests per second
# Statistics > I/O Graph with http.request as Y-axis

# DNS responses much larger than queries (amplification ratio)
# Small query (approx 60 bytes) → Large response (approx 3000+ bytes)

# Wireshark filter
dns.response and frame.len > 1000

# Amplification ratio = Response size / Request size
# ANY query amplification ratio: approx 28x ~ 54x

# Wireshark Display Filter
http.request.method == "POST" and (
  http contains "UNION" or
  http contains "SELECT" or
  http contains "DROP" or
  http contains "DELETE" or
  http contains "1=1" or
  http contains "OR 1" or
  http contains "--" or
  http contains "/*"
)

POST /api/login HTTP/1.1
Host: vulnerable-app.com
Content-Type: application/x-www-form-urlencoded

username=admin' OR '1'='1&password=anything

# Abnormal response size detection
http.response and http.content_length > 10000

# Normal DNS query
api.example.com (15 characters)

# DNS Tunneling query (abnormally long domain)
dGhpcyBpcyBhIHNlY3JldCBtZXNzYWdl.tunnel.evil.com (48 characters)

# Abnormal length DNS query detection
dns.qry.name.len > 50

# TXT record queries (frequently used for tunneling)
dns.qry.type == 16

# Abnormally frequent queries to specific domain
dns.qry.name contains "tunnel.evil.com"

# Monitor large outbound traffic with tcpdump
sudo tcpdump -i eth0 'src net 10.0.0.0/8 and dst net not 10.0.0.0/8 and greater 10000' -c 100

# Outbound to abnormal ports
sudo tcpdump -i eth0 'src net 10.0.0.0/8 and not (dst port 80 or dst port 443 or dst port 53 or dst port 22)'

# Basic port scan
nmap 192.168.1.1

# Service version detection
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Aggressive scan (services, OS, scripts, traceroute)
nmap -A 192.168.1.1

# Full port scan
nmap -p- 192.168.1.1

# NSE script usage
nmap --script vuln 192.168.1.1
nmap --script ssl-heartbleed 192.168.1.1
nmap --script http-sql-injection 192.168.1.1

# Quick scan with Docker
docker run -t zaproxy/zap-stable zap-baseline.py -t https://target.com

# API scan
docker run -t zaproxy/zap-stable zap-api-scan.py -t https://target.com/openapi.json -f openapi

# Full scan
docker run -t zaproxy/zap-stable zap-full-scan.py -t https://target.com

# Install Suricata (Ubuntu)
sudo apt install suricata

# Update rules
sudo suricata-update

# Run in IDS mode
sudo suricata -c /etc/suricata/suricata.yaml -i eth0

# Custom rule examples
# /etc/suricata/rules/local.rules
# alert http any any -> any any (msg:"SQL Injection Attempt"; content:"UNION SELECT"; nocase; sid:1000001; rev:1;)
# alert dns any any -> any any (msg:"DNS Tunneling Suspected"; dns.query; content:".tunnel."; nocase; sid:1000002; rev:1;)

# Start Metasploit
msfconsole

# Search for vulnerabilities
# msf6> search type:exploit platform:linux apache

# Module usage example
# msf6> use exploit/multi/http/apache_log4j
# msf6> set RHOSTS target.com
# msf6> set RPORT 8080
# msf6> run

Traditional Model:
  [Internet] --Firewall-- [Internal Network: Trust Everything]
  → Free lateral movement after internal breach

Zero Trust:
  [Every Request] --Authentication/Authorization-- [Resource]
  → Verify every access (regardless of location)

Traditional Network:
  [Web Server] <-> [App Server] <-> [DB Server]
  All on same VLAN, free communication

Micro-segmentation:
  [Web Server] --Policy--> [App Server] --Policy--> [DB Server]
  Separate security policies for each communication
  - Web -> App: Allow port 8080 only
  - App -> DB: Allow port 5432 only
  - Web -> DB: Block

Regular TLS:
  Client -> Server: "Prove you are the real server with a certificate"
  Server -> Client: [Server certificate]
  -> Client is not verified

mTLS:
  Client -> Server: "Prove you are the real server"
  Server -> Client: [Server certificate] + "You prove yourself too"
  Client -> Server: [Client certificate]
  -> Bidirectional authentication complete

const https = require('https')
const fs = require('fs')

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  ca: fs.readFileSync('ca-cert.pem'), // CA certificate
  requestCert: true, // Request client certificate
  rejectUnauthorized: true, // Reject invalid certificates
}

const server = https.createServer(options, (req, res) => {
  const clientCert = req.socket.getPeerCertificate()
  console.log('Client CN:', clientCert.subject.CN)
  res.writeHead(200)
  res.end('Mutual TLS authenticated!\n')
})

server.listen(443)

# Istio PeerAuthentication - Enforce mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT # mTLS required

---
# Istio AuthorizationPolicy - Fine-grained access control
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-access
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-server
  rules:
    - from:
        - source:
            principals: ['cluster.local/ns/production/sa/frontend']
      to:
        - operation:
            methods: ['GET', 'POST']
            paths: ['/api/v1/*']

# Kubernetes NetworkPolicy - Pod-to-Pod communication control
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to: # Allow DNS
        - namespaceSelector: {}
      ports:
        - protocol: UDP
          port: 53

---
# Pod Security Standards
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: myapp:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      resources:
        limits:
          memory: '256Mi'
          cpu: '500m'

# Nginx configuration
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # HSTS header (2 years, include subdomains, preload)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # TLS configuration
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
}

// Express.js - Secure CORS configuration
const cors = require('cors')

const corsOptions = {
  origin: ['https://app.example.com', 'https://admin.example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400, // Preflight cache 24 hours
}

app.use(cors(corsOptions))

// Never do this:
// app.use(cors());  // Allows all origins = security vulnerability

// Express.js - Rate Limiting
const rateLimit = require('express-rate-limit')

// General API
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Max 100 requests
  message: 'Too many requests, please try again later.',
  standardHeaders: true,
  legacyHeaders: false,
})

// Login endpoint (stricter)
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts, please try again after 15 minutes.',
})

app.use('/api/', apiLimiter)
app.use('/api/login', loginLimiter)

// Input validation with Joi
const Joi = require('joi')

const userSchema = Joi.object({
  username: Joi.string().alphanum().min(3).max(30).required(),
  email: Joi.string().email().required(),
  password: Joi.string()
    .min(12)
    .pattern(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])/)
    .required(),
  age: Joi.number().integer().min(13).max(120),
})

app.post('/api/register', (req, res) => {
  const result = userSchema.validate(req.body)
  if (result.error) {
    return res.status(400).json({
      error: result.error.details[0].message,
    })
  }
  // Process after validation passes
})

// Node.js + PostgreSQL - Safe queries
const { Pool } = require('pg')
const pool = new Pool()

// Never do this (SQL Injection vulnerable):
// const query = `SELECT * FROM users WHERE id = ${userId}`;

// Correct way: Parameterized Query
async function getUser(userId) {
  const result = await pool.query('SELECT id, username, email FROM users WHERE id = $1', [userId])
  return result.rows[0]
}

// Using ORM (Prisma)
async function getUserPrisma(userId) {
  return await prisma.user.findUnique({
    where: { id: userId },
    select: { id: true, username: true, email: true },
  })
}

// JWT security best practices
const jwt = require('jsonwebtoken')

// Access Token: Short expiry
const accessToken = jwt.sign({ userId: user.id, role: user.role }, process.env.JWT_SECRET, {
  expiresIn: '15m', // 15 minutes
  algorithm: 'RS256', // RSA asymmetric key
  issuer: 'api.example.com',
  audience: 'app.example.com',
})

// Refresh Token: Stored in DB, rotation applied
const refreshToken = jwt.sign(
  { userId: user.id, tokenVersion: user.tokenVersion },
  process.env.REFRESH_SECRET,
  { expiresIn: '7d' }
)

// Verification middleware
function verifyToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1]
  if (!token) return res.status(401).json({ error: 'No token' })

  try {
    const decoded = jwt.verify(token, process.env.JWT_PUBLIC_KEY, {
      algorithms: ['RS256'],
      issuer: 'api.example.com',
      audience: 'app.example.com',
    })
    req.user = decoded
    next()
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' })
  }
}

# HashiCorp Vault usage example
vault kv put secret/myapp/db \
  username="dbuser" \
  password="supersecret" \
  host="db.internal.example.com"

# Read from application
vault kv get -field=password secret/myapp/db

// AWS Secrets Manager
const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager')

async function getSecret(secretName) {
  const client = new SecretsManagerClient({ region: 'us-east-1' })
  const response = await client.send(new GetSecretValueCommand({ SecretId: secretName }))
  return JSON.parse(response.SecretString)
}

// Usage
const dbCreds = await getSecret('production/database')

// Security headers with Helmet.js
const helmet = require('helmet')

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        imgSrc: ["'self'", 'data:', 'https:'],
        connectSrc: ["'self'", 'https://api.example.com'],
        fontSrc: ["'self'", 'https://fonts.gstatic.com'],
        objectSrc: ["'none'"],
        mediaSrc: ["'none'"],
        frameSrc: ["'none'"],
      },
    },
    crossOriginEmbedderPolicy: true,
    crossOriginOpenerPolicy: true,
    crossOriginResourcePolicy: { policy: 'same-site' },
    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
    noSniff: true, // X-Content-Type-Options: nosniff
    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
    xssFilter: true, // X-XSS-Protection
  })
)

# npm audit
npm audit
npm audit fix

# Snyk
npx snyk test
npx snyk monitor

# GitHub Dependabot (auto PR creation)
# .github/dependabot.yml

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'weekly'
    open-pull-requests-limit: 10
    reviewers:
      - 'security-team'
    labels:
      - 'dependencies'
      - 'security'

Entry Level (0-1 years):
  CompTIA Security+
  ├── Difficulty: 2/5
  ├── Cost: ~$404 (exam fee)
  ├── Prep Time: 2-3 months
  ├── Content: Security fundamentals, threats, cryptography, network security
  └── Career Impact: IT security entry, required for government/military roles

Intermediate (1-3 years):
  CEH (Certified Ethical Hacker)
  ├── Difficulty: 3/5
  ├── Cost: ~$1,199 (exam fee)
  ├── Prep Time: 3-4 months
  ├── Content: Hacking techniques, vulnerability analysis, penetration testing
  └── Career Impact: Security analyst, pentester

  CISSP (Security Management Path)
  ├── Difficulty: 4/5
  ├── Cost: ~$749 (exam fee)
  ├── Prep Time: 4-6 months (requires 5 years experience)
  ├── Content: Security management, governance, risk management
  └── Career Impact: CISO, security architect

Advanced (3+ years):
  OSCP (Offensive Security Certified Professional)
  ├── Difficulty: 5/5
  ├── Cost: ~$1,649 (training + exam)
  ├── Prep Time: 6-12 months
  ├── Content: 24-hour hands-on penetration testing exam
  └── Career Impact: Senior pentester, red team

Web Developers:
  Security+ → CEH → OSCP → Bug Bounty

Cloud Developers:
  Security+ → AWS Security Specialty → CCSP

DevOps Engineers:
  Security+ → CKS (Kubernetes Security) → OSCP