If you click on the Map button at the bottom of the screen (shown in Figure 9 above), Wireshark will show you a map, providing its best guess of the location of the IP addresses you’ve identified. In some cases, it is even possible to use Wireshark to identify the geographic location of the source and destination traffic. If you go to Statistics and then select Conversations, you will see a summary of conversations between endpoints, as shown below: It’s also possible to capture the amount of traffic generated between one system and another. Many times, cybersecurity pros use Wireshark as a quick and dirty way to identify traffic bursts during attacks. In this case, three major traffic bursts were generated. The spikes in the graph are bursts of traffic that were caused by generating a Distributed Denial of Service (DDoS) attack using a few Linux systems. The above graph is showing typical traffic generated by a home office. For this in Wireshark, just go to statistics > I/O graph, and there we can see a graph like shown below: It is also possible to view the input/output statistics of an entire packet capture. In Wireshark, we are not limited to just interpreting packets by colors. It’s possible, even, to colorize specific conversations between computers. It’s a toggle, so if you want the coloring back, simply go back and click Colorize Packet List again. If you don’t want any coloring at all, go to View, then click Colorize Packet List.

We can even change the defaults or apply a custom rule.

You can view this by going to View > Coloring Rules. The default coloring scheme is shown below figure. Windows-specific traffic, including Server Message Blocks (SMB) and NetBIOS So Wireshark tries to help you identify packet types by applying common-sense color coding. Now we’ll go a bit more deep into Wireshark and see how to read the captured packets. In my previous blog, I explained Wireshark, Its installation, and how to use it.

How to interpret wireshark capture