Step 158. Packet Sniffing Advanced — The Two Faces of Filters and Reassembling Conversations

Level 2 — Introduction to Security and Attack Skill Basics | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Steps 83~85 (capture, filters, HTTP/HTTPS comparison) and Step 157 (plaintext credential exposure) complete. You can read pcaps with tshark.

What you need: WSL Linux + tshark, Python 3 + Flask (for the plaintext login server), 2 terminals.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Today’s capture range is inside your own computer only (lo, loopback).
Measurement note: every output in this chapter was measured on 2026-09-09 on WSL Linux (TShark 4.2.2, Flask 3.1, curl 8.5).

So far you’ve learned the basics of "capture, filter, read packets." Today you learn three analyst skills — distinguishing capture filters from display filters (filtering while catching vs. viewing after catching), TCP stream reassembly (threading scattered packets into one conversation), and conversation statistics (drawing a map of who talked to whom, and how much).

With these three in place, large captures stop being scary. Pulling exactly "the one login" out of tens of thousands of packets and reading that conversation whole from start to finish — that’s today’s goal. At the end, you’ll deliberately cause a plaintext HTTP login and confirm the password reads out whole with a single stream reassembly.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the difference between capture filters (BPF syntax) and display filters (Wireshark syntax), and use each correctly
Search contents and flags with tcp contains and tcp.flags combinations
Reassemble scattered packets into one conversation with Follow TCP Stream
Draw a communication map with Conversations statistics
Extract plaintext-login credentials from a stream and explain the risk it implies

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	WSL Linux terminal, tshark (command-line Wireshark), a simple Flask server
Today’s commands	`tshark -f` (capture filter), `-Y` (display filter), `-z follow,tcp,ascii,N`, `-z conv,tcp`, `tcp contains`
Concepts needed	BPF syntax vs. display-filter syntax, TCP streams, session reassembly, Step 84’s flags
Today’s artifact	`sniff.pcap` + an analysis note — the complete reconstruction of one specific conversation

2-1. Filters Come in Two Kinds — The Filtering Point Differs

The same word "filter" splits into two in Wireshark.

Category	Capture filter	Display filter
Timing	Filters from the moment of capture	Filters at display time, from what’s caught
Syntax	BPF (`tcp port 80`, `host 10.0.0.1`)	Wireshark (`tcp.port==80`, `http`)
tshark option	`-f "..."`	`-Y "..."`
Use	Saving space on large volumes	Narrowing your view during analysis
Caution	Filtered packets aren’t in the file — irreversible	Original is intact — release the filter anytime

The rule is this — only "things you can afford to throw away" go in the capture filter; everything else goes in the display filter. Capture filters are powerful, but what they filter is gone forever.

2-2. TCP Streams — Packets Are Fragments, a Stream Is a Conversation

The packet list is a pile of envelopes. The actual conversation (an HTTP request and response, a login exchange) rides split across several packets. Follow TCP Stream threads the fragments of one connection in order and shows you the "full transcript" — the most-used feature in analysis. In tshark, -z follow,tcp,ascii,streamnumber corresponds to it.

2-3. Conversations — Read the Map First

When there are tens of thousands of packets, reading line by line isn’t navigation. Conversations (conversation statistics) is a map summarizing the entire capture as "who talked to whom, how many packets, how many bytes." The field order is: first mark the strange conversations here (a large transfer at dawn, a counterparty you’ve never seen), then dig into just those conversations via streams.

2-4. Today’s Stage — A Loopback Login Server

For safe practice, we run a plaintext login server that lives only inside your computer. Since the capture range is lo (loopback) only, other people’s traffic physically cannot mix in.

3. Follow Along

3-1. Setting the Stage — A Plaintext Login Server and a Capture

Create a simple server (sniff_lab.py) in WSL.

from flask import Flask, request
app = Flask(__name__)

@app.route("/")
def index():
    return "sniff-lab index page\n"

@app.route("/login", methods=["POST"])
def login():
    return f"login try: {request.form.get('username')} / {request.form.get('password')}\n"

if __name__ == "__main__":
    app.run(host="127.0.0.1", port=8000)

Start the server in terminal 1, and in terminal 2 start a capture with a capture filter — the capture filter‘s (-f) first appearance.

tshark -i lo -f "tcp port 8000" -a duration:8 -w sniff.pcap

While the capture runs, perform three actions in terminal 3 — view the page twice, log in once.

curl -s http://127.0.0.1:8000/ > /dev/null
curl -s -X POST -d "username=admin&password=sup3r-secret-pw" http://127.0.0.1:8000/login > /dev/null
curl -s http://127.0.0.1:8000/ > /dev/null

Output (measured 2026-09-09, part of the capture summary):

    1 0.000000000    127.0.0.1 → 127.0.0.1    TCP 74 48258 → 8000 [SYN] ...
    4 0.000096420    127.0.0.1 → 127.0.0.1    HTTP 143 GET / HTTP/1.1
   16 0.005894011    127.0.0.1 → 127.0.0.1    HTTP 257 POST /login HTTP/1.1  (application/x-www-form-urlencoded)
   28 0.012230354    127.0.0.1 → 127.0.0.1    HTTP 143 GET / HTTP/1.1
   (36 packets total)

How to read it: thanks to the capture filter, only port-8000 conversations entered the file from the start — noise packets never existed. Inside 36 packets you can see three connections (three sets of three-way handshakes).

3-2. Display Filter 1 — Counting Only New Connections

Now view the captured file with a display filter (-Y). Just the conversation openers (SYN and not ACK):

tshark -r sniff.pcap -Y "tcp.flags.syn == 1 and tcp.flags.ack == 0"