Reference Article • v1.0

Ethical Network Traffic Analysis

This infographic serves as an ethical and technical primer for individuals using network analysis tools such as Wireshark.

Topic

The topic is Ethical Network Traffic Analysis. It combines a legal and ethical warning regarding the capture of data packets with a quick-reference guide for filtering network traffic using tools like Wireshark.

Detailed Description

The infographic is divided into two primary sections under a bold header reading "IMPORTANT REMINDER."

Warning Section (Left)

Capture traffic only on networks you own or have permission to analyze.

Four guiding principles:

Respect privacy

Follow laws & regulations

Use ethically & responsibly

Protect sensitive information

Technical Section (Right)

Titled "Useful Filters", this section contains a table of common network protocol filters used to isolate specific types of traffic.

Learn responsibly.

Network Protocol Filters

The following Wireshark display filters isolate specific traffic types:

Filter	Traffic Type	Description
`http`	HTTP	Hypertext Transfer Protocol
`dns`	DNS	Domain Name System
`tcp`	TCP	Transmission Control Protocol
`udp`	UDP	User Datagram Protocol
`ip.addr == 192.168.1.1`	IP	Traffic to/from a specific host

Concepts & Data

HTTP traffic — Hypertext Transfer Protocol
DNS traffic — Domain Name System
TCP traffic — Transmission Control Protocol
UDP traffic — User Datagram Protocol
IP address 192.168.1.1 — filtering traffic to/from a specific host

What Makes This Unique

What makes this infographic unique is the explicit juxtaposition of technical "how-to" knowledge with legal and ethical constraints.

Rather than providing a technical cheat sheet in isolation, it frames the ability to filter network traffic — a skill that can be used for both network administration and malicious hacking — within a strict ethical framework. It prioritizes "permission" and "legality" as the prerequisite for using the technical commands listed.

Using These Filters in Wireshark

Enter any filter into the Wireshark Display Filter bar at the top of the window. The capture will update in real time to show only matching packets.

http         # show only HTTP packets
dns          # show only DNS queries/responses
tcp          # show only TCP segments
udp          # show only UDP datagrams
ip.addr == 192.168.1.1  # traffic to or from that address

Combine filters with logical operators:

http and ip.addr == 192.168.1.1
dns or udp.port == 53
not arp