DEV Community: Rithanya Angappan

Practical Website Traffic Analysis Using Wireshark

Rithanya Angappan — Fri, 28 Aug 2026 15:32:57 +0000

Have you ever wondered what happens behind the scenes when you open a website?

When we enter a website address in a browser, several network processes take place before the webpage is displayed. These include DNS resolution, TCP connection establishment, TLS negotiation, and encrypted HTTPS communication.

In this practical analysis, I used Wireshark to capture and analyze the network traffic generated while accessing a website. The website name is not mentioned in this article for privacy purposes.

The main purpose of this practical was to understand how different network protocols work together during a real-world web browsing session.

What is Wireshark?

Wireshark is an open-source network protocol analyzer used to capture and inspect network packets.

It allows us to observe network communication in detail, including:

Source and destination IP addresses
Protocols
Port numbers
Packet sizes
TCP connections
DNS requests
TLS communication
Network conversations

Wireshark is widely used for network troubleshooting, security analysis, and learning how network protocols work.

Objective

The objective of this practical was to:

Capture website-related network traffic using Wireshark
Analyze DNS requests and responses
Understand the TCP three-way handshake
Examine TLS traffic

Operating System: Windows

Network Connection: Wi-Fi

Tool Used: Wireshark

Browser: [Chrome / Edge / Firefox]

Target: A website used for practical analysis

Packet Capture

First, I opened Wireshark and selected the Wi-Fi network interface because my Windows system was connected to the internet through Wi-Fi.

I started the packet capture and then opened the target website in a web browser. After allowing the website to load completely, I performed a few normal browsing actions and then stopped the capture.

This gave me a collection of packets that could be analyzed using Wireshark.

1. DNS Analysis

The first part of the analysis was DNS traffic.

I used the following Wireshark display filter:

dns

DNS, or Domain Name System, is responsible for resolving domain names into IP addresses.

By examining the DNS packets, I was able to observe the DNS query and response generated during the website access.

The DNS response provided information about the IP address associated with the requested domain.

2. TCP Three-Way Handshake

Next, I analyzed TCP traffic using:

tcp

TCP uses a three-way handshake to establish a reliable connection between the client and server.

The three stages are:

Client → Server : SYN
Server → Client : SYN-ACK
Client → Server : ACK

The first packet contains the SYN flag.

The server responds with SYN-ACK.

Finally, the client sends an ACK packet.

This process establishes the TCP connection before further communication takes place.

3. TLS Analysis

Since modern websites generally use HTTPS, I also analyzed TLS traffic.

I used the following filter:

tls

I observed TLS handshake packets, including the Client Hello and Server Hello messages.

The Client Hello contains information used during the TLS negotiation, such as supported cryptographic parameters and extensions.

One important observation was that the actual webpage content was not visible as normal readable text in the packet capture because the communication was encrypted.

Key Observations

From this practical analysis, I observed the following:

Analysis Observation
DNS Domain resolution traffic was observed
TCP Three-way handshake was observed
TLS TLS handshake packets were observed

This practical helped me understand that opening a website involves much more network communication than what is visible in a browser.

I learned how:

DNS converts a domain name into an IP address.
TCP establishes a reliable connection using a three-way handshake.
TLS helps establish secure communication.
HTTPS encrypts application data.
Wireshark can be used to inspect packets and understand network activity.
Protocol hierarchy and conversation statistics can provide a broader view of network traffic.
Conclusion

Wireshark provides a useful way to understand what happens behind the scenes when accessing a website.

Through this practical analysis, I was able to observe DNS resolution, TCP connection establishment, TLS negotiation, IP communication, and encrypted HTTPS traffic.

The practical also helped me understand an important cybersecurity concept: network packets can reveal useful information about communication, while encryption helps protect the actual application data from being viewed as plain text.

Overall, this hands-on exercise gave me a better understanding of network protocols and how Wireshark can be used for network analysis and cybersecurity learning.

Disclaimer

This analysis was performed for educational and cybersecurity learning purposes on a website that I was authorized to access. No attempt was made to bypass security mechanisms, access unauthorized information, or interfere with the website's operation.

cybersecurity#networking#wireshark

Wireshark: A Beginner Guide to Network Packet Analysis

Rithanya Angappan — Wed, 26 Aug 2026 07:11:50 +0000

Introduction
In cybersecurity and networking, understanding what is happening inside a network is extremely important. When a website is opened, an application sends a request, or a device communicates with a server, a large amount of network traffic is exchanged in the background.

But how can we actually see and analyze this traffic?

This is where Wireshark comes in.

Wireshark is a free and open-source network protocol analyzer that allows us to capture and inspect network packets. It is widely used by network administrators, cybersecurity professionals, developers, and students to understand network communication and troubleshoot problems.

What is Wireshark?

Wireshark is a tool used to capture and analyze packets travelling through a network.

Think of network communication like sending letters between two people. Each letter contains information about where it came from, where it is going, and what it contains.

Similarly, network communication is divided into packets. Wireshark allows us to examine these packets and understand how devices communicate.

Wireshark can:

Capture live network traffic
Analyze previously captured traffic
Inspect different network protocols
Filter packets
Troubleshoot network problems
Investigate suspicious network activity
Understand how protocols work

Wireshark supports live capture from network interfaces such as Ethernet and Wi-Fi and can also analyze saved capture files.

Why is Wireshark Important in Cybersecurity?

For cybersecurity professionals, network traffic can provide valuable information about what is happening on a system or network.

For example, Wireshark can help investigate:

Suspicious connections
Unusual IP addresses
Unexpected network communication
DNS requests
TCP connections
HTTP traffic
Network troubleshooting
Possible malware communication
Protocol-related problems

However, Wireshark itself does not automatically tell you whether traffic is malicious. The analyst needs to understand the packets, protocols, IP addresses, ports, and communication patterns.

How Does Wireshark Work?

The basic process is:

Network Interface → Packet Capture → Packet Dissection → Filtering → Analysis

When Wireshark starts capturing, it listens to a selected network interface and records packets that are visible to that interface.

The captured packets are then broken down into protocol layers so that the user can inspect their individual fields.

Wireshark's interface commonly contains three important sections:

Packet List Pane
Packet Details Pane
Packet Bytes Pane

The packet list provides a summary of captured packets, while selecting a packet allows its protocol details and raw bytes to be examined.

Understanding a Packet

A packet contains different pieces of information.

For example, when analyzing an IP packet, you may find information such as:

Source IP address
Destination IP address
Protocol
Packet length
Time
Header information
Payload data

Wireshark breaks the packet into protocol layers, making it easier to understand the communication.

A simplified example is:

Ethernet → IP → TCP → Application Protocol

Each layer provides additional information about the communication.

Capturing Packets with Wireshark

To capture traffic:

Step 1: Open Wireshark

Launch Wireshark on your computer.

Step 2: Select a Network Interface

Wireshark will display available interfaces such as:

Wi-Fi
Ethernet
Loopback

Choose the interface through which the traffic you want to analyze is travelling.

Step 3: Start Capture

Start the packet capture.

You will see packets appearing in real time.

Step 4: Generate Some Traffic

For example, open a website or perform another network activity.

Wireshark will capture the packets generated by that activity.

Step 5: Stop the Capture

Once enough traffic has been collected, stop the capture and begin analyzing the packets.

Wireshark's official documentation describes live packet capture as one of its major features.

What are Wireshark Filters?

One of the most useful features of Wireshark is filtering.

A busy network can generate thousands of packets. Looking through every packet manually would be difficult.

Filters allow us to focus only on the traffic we are interested in.

Wireshark has two important types of filters:

1. Capture Filters

Capture filters determine what traffic is captured in the first place.

They are useful when you already know what type of traffic you want to capture.

2. Display Filters

Display filters are applied after packets have been captured. They control which packets are displayed without deleting the other packets from the capture.

Useful Wireshark Display Filters

Here are some beginner-friendly examples:

Show TCP packets

tcp

This displays packets containing TCP.

Show UDP packets

udp

Show DNS traffic

dns

Show HTTP requests

http.request

Filter by IP address

ip.addr == 192.168.1.10

Show traffic from a specific IP

ip.src == 192.168.1.10

Show traffic going to a specific IP

ip.dst == 192.168.1.10

Wireshark's documentation supports filtering by protocols, fields, values, and comparisons.

TCP Analysis in Wireshark

TCP is one of the most important protocols to understand when learning Wireshark.

A TCP connection commonly begins with the three-way handshake:

Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server

This establishes a TCP connection between the two systems.

In Wireshark, you can filter TCP traffic using:

tcp

You can then inspect TCP flags such as:

Understanding these flags can help when troubleshooting connection problems and analyzing network behavior.

DNS Analysis

DNS converts domain names into IP addresses.

For example:

example.com → IP address

When a device accesses a domain, it may first send a DNS query.

In Wireshark, you can use:

dns

to focus on DNS packets.

You can then examine:

DNS queries
DNS responses
Requested domains
Response addresses
Query types

DNS analysis can be useful during troubleshooting and security investigations.

Wireshark in a Cybersecurity Investigation

Imagine a security analyst notices that a computer is making unusual connections.

The analyst could use Wireshark to investigate:

Source IP
     ↓
Destination IP
     ↓
Protocol
     ↓
Port
     ↓
Packet Contents / Metadata
     ↓
Communication Pattern

By examining these details, the analyst can develop a better understanding of the network activity.

Wireshark can therefore be useful during:

Incident investigation
Network troubleshooting
Malware analysis
Security monitoring
Protocol analysis
Network forensics

Advantages of Wireshark

Free and Open Source

Wireshark is freely available and open source.

Detailed Packet Analysis

It provides detailed information about network packets and supports inspection of hundreds of protocols.

Powerful Filtering

Filters make it possible to focus on specific protocols, addresses, fields, and values.

Cross-Platform

Wireshark runs on multiple operating systems, including Windows, Linux, and macOS.

Useful for Learning

Students can use Wireshark to understand how networking protocols work in real-world traffic.

Limitations of Wireshark

Wireshark is powerful, but it is not a magic cybersecurity tool.

Some limitations include:

Large captures can contain huge amounts of data.
Beginners may find packet details confusing.
Encrypted traffic limits visibility into application contents.
Understanding packets requires networking knowledge.
Capturing traffic does not automatically identify an attack.

To use Wireshark effectively, it is helpful to understand concepts such as TCP/IP, DNS, HTTP, TCP, UDP, IP addresses, ports, and network layers.

Beginner Practice Idea

If you're learning cybersecurity, try this simple experiment.

Experiment

Open Wireshark.
Select your active network interface.
Start capturing.
Open a website in your browser.
Stop the capture.
Apply:

dns

Examine the DNS packets.
Then try:

tcp

Select a TCP packet.
Explore the Ethernet, IP, and TCP sections.

This simple exercise can help you understand how a normal web request generates network traffic.

Conclusion

Wireshark is one of the most useful tools for learning and analyzing computer networks.

It allows us to move beyond simply knowing that devices communicate and actually examine how that communication happens.

For cybersecurity students, learning Wireshark can build a strong foundation in:

Networking → Packet Analysis → Protocols → Troubleshooting → Security Investigation

The most important thing is not just learning Wireshark commands. The real skill is learning how to interpret the information inside the packets.

Once you understand networking fundamentals, Wireshark becomes much easier—and much more powerful.

wireshark#cybersecurity#networktool#ethicalhacking

App store Submission : Rules and regulations every developer must know

Rithanya Angappan — Tue, 25 Aug 2026 15:07:23 +0000

Publishing an iOS app is more than uploading a build. Apple reviews your app for functionality, privacy, security, content, and usability.

1. Apple Developer Account
Enroll in the Apple Developer Program to access App Store Connect and identifiers.

2. App Store Connect
Use App Store Connect to create listing, upload builds, add screenshots, provide privacy details, set pricing, and submit your app for review.

3. App Quality
Your app should be functional. Test login, registration, navigation, forms, buttons, search, notifications, payments, database operations, and APIs. Avoid crashes, broken features, and unfinished pages.

4. Backend & Login
Backend services must be accessible to Apple reviewers. Avoid localhost URLs. If login is required, provide demo credentials.

5. Privacy & Security
Provide Privacy Policy and declare collected data such as names, emails, locations, photos, and financial information. Protect passwords and data.

6. Copyright & Content
Use content you have permission to use, including images, music, videos, logos, fonts, and software. Avoid illegal, harmful, fraudulent, discriminatory, or inappropriate content.

7. App Store Listing
App name and subtitle can each be up to 30 characters. Provide descriptions, screenshots, icons, age ratings, categories, and keywords.

8. Review & Rejection
Apple may approve or reject it. Common rejection reasons include crashes, unavailable backends, missing privacy information, misleading screenshots, copyright issues, broken links, and payment violations.

🚀 Final Tip: Test everything, verify privacy information, and ensure the app is complete before submitting.

iOS #AppStore #Apple #AppDevelopment #MobileDevelopment