Zkitszo - The Real
October 01, 2025

Getting Down with Wireshark as a Network Monitoring Tool

Wireshark. When you need to get down and dirty with individual packets, nothing touches it. But what happens when you're trying to figure out what's actually going on across a fast, chaotic network? Not just the wireless activity, but who's active, what they're doing, and what you can actually see? Scrolling through a billion packets to find out who's hogging all the bandwidth with Netflix isn't a headache, it's basically impossible.

Wireshark is a microscope, but sometimes you want a satellite view. You want the big picture: what apps are running, who the top talkers are, and whether something sketchy is going on, without spending an hour building a filter the length of your arm.

ntop's nDPI

That's where nDPI (ntop Deep Packet Inspection) comes in.

Standard Wireshark is a mailman who only reads the outside of the envelope, the packet header. It sees the to/from addresses and the port number, but has no clue what's inside. nDPI gives that mailman x-ray vision. It looks inside the packet data to identify the actual application, regardless of port. It'll tell Skype from BitTorrent from Office 365 from Facebook, even when they're trying to hide.

How it works: Extcap + Lua

So how do you get this into Wireshark? The setup Luca Deri from ntop put together uses two pieces, and it doesn't even make you recompile Wireshark.

  1. Extcap plugin. This is an "external capture" module. It grabs the traffic, runs it through the nDPI engine to work out the real protocol, then tags each packet with that info before handing it off to Wireshark.

  2. Lua script. A small script that tells Wireshark how to read those new tags. That's what unlocks display filters like ndpi.protocol.name == "Netflix". That easy.

Turning Wireshark into a monitoring dashboard

This is more than just filters. The Lua script also unlocks a whole set of analysis tools that turn Wireshark into a proper network monitoring app. You can generate reports on the spot for a bird's-eye view of your traffic. Stuff like:

  • Top applications. A breakdown of traffic by app. See how much bandwidth YouTube, Facebook, and Office 365 are really eating.

  • DNS deep dive. Top DNS clients, resolvers, and queries. A good way to catch misconfigurations or sketchy malware behavior.

  • SSL/TLS insights. Analyze SSL certificates to see which servers your users are hitting. You can even spot the weird, algorithmically-generated domains that Tor or malware use.

  • Passive recon. Identify device types and operating systems just by watching DHCP and HTTP traffic. Count the iPhones, Windows PCs, or even HP printers on your network.

  • Latency checks. Measure network and application latency to figure out whether it's the network or the server that's slow.

The bottom line

Pair Wireshark with nDPI and you get both ends of it. You can still dig into a single packet when you need to, and you can zoom out for the high-level, actionable picture in seconds. Big step up for anyone doing network analysis. If you're building out a kit, it slots right in next to the rest of my network tools.

Sources


Comments

Post a Comment