The network tells the truth even when nobody is listening. Every port scan, every forged ARP reply, every machine calling home on a schedule leaves a trail of packets, and Wireshark remains the most direct way to read it. Installing the tool takes two minutes. Knowing which traffic deserves attention takes longer. What follows is a working routine: capture in the right place, learn what normal looks like, then use display filters that isolate the three things most worth catching — scans, ARP spoofing, and connections that don't belong.
Capture only on networks you own or have written permission to monitor. Watching traffic that isn't yours can be illegal regardless of your intent.
On a switched network, your laptop's NIC sees only traffic addressed to it, plus broadcasts and multicasts. That is still useful — ARP is broadcast, and your own outbound connections are the ones you most want to audit — but to watch another host you need a mirror (SPAN) port on the switch or a network tap. Ask whoever runs the network before assuming you can see everything. A SPAN port copies frames to your interface; a tap sits inline and copies both directions, which is the more honest option when you need to prove nothing was dropped.
Wireless is a different problem. Unless you put a supported adapter into monitor mode, you capture only your own traffic and some management frames. Monitor mode on the right channel shows you the air, but on a busy office floor that is a firehose — pick the channel you care about rather than letting the card hop.
Promiscuous mode matters mainly on mirrored ports and old hub-based segments; it tells the card to accept frames not addressed to it. On a normal switched port it changes nothing.
Resist the urge to load up capture filters. It's tempting to type host 10.0.0.50 and start, but the packet you didn't capture is the one you'll want later. Capture everything, filter afterward. If you're recording for hours, use dumpcap or tshark with a ring buffer — -b filesize:100000 -b files:10 -w evidence.pcapng — which keeps ten 100 MB files and rolls over the oldest. Disk space is cheap; a ruined investigation is not.
Two housekeeping habits pay off. Capture as close to the suspect host as you can, because less of the network means less noise between you and the answer. And make sure the capture machine's clock is right. When you line a packet timestamp up against a firewall log six hours later, a clock that drifted ninety seconds will send you chasing the wrong connection.
Anomaly detection is a comparison, and you cannot compare without a baseline. Before anything goes wrong, capture a quiet ten minutes during a normal workday and study it.
Write the answers down, or save a profile. The goal is a mental photograph of Tuesday at 2 p.m., so that Thursday at 3 a.m. you can tell the difference between a scheduled backup and something new.
A TCP SYN scan is the easiest to spot because it never completes. Each probe sends a SYN; the target answers with SYN/ACK if the port is open or RST/ACK if it is closed, and the scanner never follows through. In the display filter bar, type tcp.flags.syn == 1 && tcp.flags.ack == 0. That returns every initial SYN. On a busy network you will get plenty of legitimate ones, so narrow by source: ip.src == 10.0.0.50 && tcp.flags.syn == 1 && tcp.flags.ack == 0. If one address appears with dozens of destination ports in a few seconds, you have a scan.
Two other shapes are worth knowing. A full connect scan completes the three-way handshake, so it looks like ordinary traffic until you notice the same source touching ports 22, 23, 80, 135, 139, 443, 445, and 3389 within two seconds. A UDP scan announces itself through the replies it provokes: filter icmp.type == 3 && icmp.code == 3 for the port-unreachable messages that closed UDP ports generate. A burst of those from one host is a scan of something.
Remember that scanners can be slow and quiet. Run with a two-second delay between probes and a sweep looks like nothing at all until you sort by destination port. That is why the Conversations window, not the filter bar, is the fastest way to catch a low-and-slow scan.
ARP has no authentication, so any host can claim any address. A spoofer sends forged replies so that traffic meant for the gateway passes through it instead. Wireshark flags the classic version for you: filter arp.duplicate-address-detected and see whether anything appears. That catches the moment two MAC addresses claim the same IP.
To watch by hand, filter arp.opcode == 2 for replies only, since requests are normal and constant. Then look at who is answering. A healthy network has one MAC per IP and one IP per MAC, stable for months. A machine that answers for the gateway, for a server, and for a printer it does not own is either badly misconfigured or hostile. Sorting Statistics > Endpoints > Ethernet and comparing the result against the MAC table on your switch turns suspicion into evidence.
The other signature is a gratuitous ARP burst — dozens of replies in a second, all announcing the same address. That is how a spoofer takes over after the real host has sent its own announcement.
The third category is the quietest: traffic that is allowed but should not be there. Command-and-control rarely looks like an attack. It looks like a laptop checking in with a server every sixty seconds, forever.
Start with one host and look at the rhythm. Filter ip.addr == 10.0.0.50, sort by time, and read the intervals. Regularity is the tell. A browser makes requests in bursts with human pauses; a beacon fires at 60.0, 119.8, and 180.1 seconds. Some malware adds jitter to hide that, which is why the destination matters more than the interval.
DNS is often the only visible part. Filter dns and scan query names for long, random-looking labels — thirty characters of base32 under a domain nobody in the company would visit — the fingerprint of DNS tunneling. For encrypted traffic, tls.handshake.extensions_server_name lists the hostnames clients ask for, and tls.handshake.type == 1 narrows to Client Hello messages. An internal server with no business on the internet, resolving and connecting to a domain registered three weeks ago, is the finding you were looking for.
Filters find candidates. Four more tools turn a candidate into a conclusion.
Ad hoc clicking produces ad hoc answers. A short fixed sequence keeps you from missing the obvious.
Skill here comes from repetition on traffic where the answer is already known. Run a port scan against a machine you own with Wireshark open, and watch what it actually looks like. Spoof AR
Photo: Sergei Starostin / Pexels
