In this paragraph we will go through some of Wireshark's features for analyzing saved traffic.

### Features of Online Storage

By selecting *Statistics -> Capture File Properties *the following window opens.

![](sanity:image-7a6cdfe2fba85f9f5fd701d83225f6c2533bcc98-940x732-png)

From this window you can see, among other things.

- Recording start, end, and duration
- General information related to the file
- Total package of recording quantity and other statistics.

### Protocol hierarchy

By selecting *Statistics -> Protocol Hierarchy *, you can see the protocol hierarchy and the percentage of packets related to specific protocols contained in the recording. You can also see how many packets and bytes have been transmitted.

![](sanity:image-9d2dfc0370226ec4ed4d3438c30cb0d72b6d4b12-932x414-png)

This can help, for example, in a situation where you have a network environment where users complain about slow network connection and performance issues with network services. You want to determine what is causing these problems and which protocols are responsible for the slowdown of network traffic. Or let's imagine that you are responsible for the company's cybersecurity and you want to monitor network traffic to detect potential malicious activities or security-related threats. With this, you could, for example, search for protocols in the traffic that are not typical or expected in that particular network.

### Conversations - Discussions statistics

By selecting *Statistics -> Conversations *you can see the conversations contained in the recording, for example, how many packets have been sent from one address to another address and vice versa. This can help you, for example, if you sort the conversation statistics based on the amount of data from largest to smallest, which can help you identify conversations with high data transfer or unusual traffic volumes.

![](sanity:image-4ba1b58581009d42db186298bfbdaff1f3c3e951-826x307-png)

If you encounter something unusual or want to investigate a specific conversation in more detail, you can set up a search as follows.

![](sanity:image-26103061b74611ea274e95797cb04a9a8150b430-930x254-png)

### Endpoints - Endpoint Statistics

By selecting *Statistics -> Endpoints*, you will see the statistics of addresses contained in the recording, i.e. how many packets have been caused by a specific address and how many packets have been sent to or from that address.

![](sanity:image-72989f7a5ad40776ba3dab2032757f8b4b215d26-690x287-png)


Traffic analysis

Wireshark is a tool used to capture and analyze data traffic. The tool is suitable for learning different network protocols and you often need it in CTF competitions as well.

Wireshark is a tool used for capturing and analyzing network traffic. It enables the examination and analysis of network traffic in real-time or from saved PCAP files.

Wireshark is able to dissect various network protocols and display detailed information about each network packet. Security experts can use it to detect suspicious or malicious network traffic, such as the spread of malware, attacks, or phishing. It is often needed in CTF competitions as well.

Especially Wireshark is suitable for learning network protocols. You can, for example, start Wireshark, open a browser, go to Hakatemian's page, and then see the whole transaction in Wireshark.

In this course, we will learn the basics of Wireshark, such as capturing traffic, using the search field, and understanding the statistics in the Wireshark program.

Traffic analysis

Learn to hack — start here