Wireshark

What is Wireshark?

Wireshark is a free, open-source protocol analyser that captures network traffic packet by packet and decodes every packet down to its individual protocol fields. It recognises around 3,000 protocols, including nearly all of those used in industrial automation. With it you can see exactly what a PLC, HMI or SCADA server is saying on the network, and what it is not saying.

In OT networks, Wireshark is the standard tool for troubleshooting, protocol analysis and security investigation, for example with problems involving Modbus TCP, ProfiNET, OPC UA or ARP.

🕰️ Where does Wireshark come from?

Gerald Combs released the program in 1998 under the name Ethereal. He wrote it while working for Network Integration Services (NIS), which also owned the Ethereal trademark. When Combs moved to another company in 2006 he could not take the name with him, so the project continued as Wireshark in May 2006. It has since grown into one of the most widely used network analysers in the world.

Wireshark is licensed under the GPL (version 2 or later): it is free to use, including commercially, and the source code is public.

🧠 How does Wireshark work?

1. Capture - Wireshark listens to a network interface through a capture library (libpcap on Linux and macOS, Npcap on Windows). The actual capturing is done by the helper program dumpcap, so the graphical interface itself does not need administrator rights.
2. Dissect - for each protocol a dissector turns raw bytes into named fields, layer by layer as in the OSI model: Ethernet, IP, TCP or UDP, and the application protocol on top.
3. Display in three panes:

• Packet list - time, source, destination, protocol and a short summary
• Packet details - the decoded tree structure per protocol layer
• Packet bytes - the raw content in hex and ASCII

4. Filter and analyse - with filters, statistics (Conversations, Endpoints, Protocol Hierarchy, I/O Graph) and Expert Information, which flags anomalies such as retransmissions and error codes.
5. Save and share - by default in the pcapng format; .pcap is also supported, as is export to CSV, JSON, XML or plain text.

Wireshark runs on Windows, Linux, macOS and BSD, and captures on Ethernet as well as wireless interfaces such as Wi-Fi. For headless servers there is TShark, the command-line version with the same dissectors and filters.

🔍 What is the difference between capture and display filters?

Wireshark has two kinds of filter that are often confused:

A practical rule: use a capture filter only to limit the data volume on a busy network, and do the real analysis with display filters. Whatever a capture filter discards, you cannot get back later.

🏭 Which industrial protocols does Wireshark recognise?

Wireshark ships with built-in dissectors for the main OT protocols. The display filter is the short name you use to select the protocol.

Not everything is covered: Siemens’ newer S7CommPlus (S7-1200 and S7-1500) has no built-in dissector and needs a third-party plug-in. Encrypted traffic, such as OPC UA with signing and encryption or TLS, only shows the outside of the connection unless you have the keys.

🔧 How do you use Wireshark safely on an OT network?

A good capture starts with the connection point, not with the program.

1. Choose the measuring point - use a SPAN port on a managed switch or a passive network TAP. A TAP also copies errored frames and does not drop packets under peak load; a SPAN port is cheaper but can.
2. Make the analysis port receive-only - the laptop listens but sends nothing into the process network. An operating system readily sends DHCP, IPv6 or NetBIOS traffic of its own accord, so give the capture interface no IP address and disable the protocols bound to it.
3. Check that network name resolution is off - when that option is on, Wireshark sends DNS queries to translate IP addresses, which is unwanted traffic on an OT network.
4. Use a ring buffer for long captures - let dumpcap switch to a new file every 100 MB, for example, so an intermittent fault from days ago can still be found.
5. Filter with intent - ip.addr == 192.168.0.10 narrows the view to a single device, modbus.func_code == 6 shows writes to a single register, s7comm.param.func reveals read and write jobs to an S7 PLC, and tcp.analysis.retransmission points to an overloaded or faulty link.
6. Record and retain - note the measuring point, time and purpose, and store the pcapng recording with a hash value if it may serve as evidence.

🛠️ What do you use Wireshark for in practice?

• Communication between PLC, HMI and SCADA - checking whether a poll arrives, how long the response takes and which error code comes back
• Network faults - tracking down incorrect BOOTP/DHCP behaviour, duplicate IP addresses and ARP conflicts
• Modbus diagnostics - understanding exception codes and timeouts in Modbus TCP traffic
• Time synchronisation - checking NTP and PTP messages for the correct source and interval
• Unknown devices - spotting new MAC addresses, SNMP traffic and unexpected protocols to complement an asset inventory
• Security investigations - making ARP Spoofing, Man-In-The-Middle attacks or port scans visible as part of a cybersecurity investigation

Wireshark is often the first tool reached for during an incident on an OT network: it shows what is really travelling over the wire, regardless of what the documentation or configuration claims.

🔄 How does Wireshark compare with tcpdump and OT monitoring?

Wireshark is therefore not an IDS: it does not raise alerts on its own. For continuous network monitoring you use passive monitoring platforms and a SIEM; Wireshark is the magnifying glass you use to investigate an alert from those systems down to packet level.

🔐 What should you watch for regarding security and privacy?

• Only with permission - use Wireshark solely on networks you are authorised for, and agree any capture with the owner of the installation
• Sensitive content - captures can contain passwords, PLC commands and process data; IP addresses and usernames can be personal data under the AVG (the Dutch name for the GDPR)
• The tool itself is attack surface - dissectors process untrusted input and regularly have vulnerabilities; keep Wireshark up to date and do not run the interface as administrator
• Evidential value - during incident response and forensic investigation under NIS2 and the Dutch Cyberbeveiligingswet (reporting deadlines of 24 and 72 hours), an unaltered, hashed capture is valuable
• Clean up - store captures encrypted, restrict access and delete them as soon as the analysis is complete

❓ Frequently asked questions

Is Wireshark free?

Yes, Wireshark is free and open source under the GPL licence. You may also use Wireshark commercially and inside company networks without any licence fees.

Can Wireshark disrupt an industrial process?

Wireshark listens passively and does not send any process traffic itself, but enabled network name resolution can generate DNS queries. In addition, a misconfigured SPAN port can put extra load on a switch, so preferably use a TAP or a receive-only analysis port and switch name resolution off.

Can Wireshark read Siemens S7 traffic?

Wireshark decodes Siemens’ classic S7comm protocol on TCP port 102 with the display filter s7comm. For the newer, protected S7CommPlus used by the S7-1200 and S7-1500, Wireshark has no built-in dissector and a third-party plug-in is needed.

What is the difference between Wireshark and tcpdump?

Wireshark is a graphical protocol analyser with in-depth decoding of around 3,000 protocols, while tcpdump is a lightweight command-line tool for capturing traffic. Both use the same BPF syntax for capture filters, and you can simply open a tcpdump capture in Wireshark later.

Is Wireshark a replacement for an IDS?

No, Wireshark is an analysis tool for manual investigation and does not produce automatic alerts. An IDS or OT monitoring platform watches the network continuously; you use Wireshark to investigate its alerts at packet level.

Which file format does Wireshark use?

Wireshark saves captures in pcapng by default, which stores interface information and comments alongside the packets. The older pcap format is still fully supported and is interchangeable with tcpdump and most other tools.

📌 In summary

Wireshark is the free standard tool for decoding network traffic down to field level, and in OT networks it is the magnifying glass for faults and security incidents.

With around 3,000 dissectors, including Modbus TCP, S7comm, PROFINET, DNP3, IEC 60870-5-104 and GOOSE, Wireshark reveals what PLCs, HMIs and SCADA systems actually exchange. Connect it passively through a TAP or SPAN port, keep name resolution off, use display filters for the analysis and treat captures as sensitive data. For continuous monitoring, Wireshark complements an IDS or OT monitoring platform but does not replace it.