Wireshark

Purpose

Use this skill when packet-level evidence is needed to understand protocol behavior or defensive visibility.

Phase Fit

• Primary: Detection and Response Assessment
• Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration

Use When

• Need to confirm protocol behavior, cleartext exposure, or unexpected service interactions.
• Need to compare observed traffic against what defenders can see and alert on.
• Need to troubleshoot whether a validation path is behaving as expected.

Avoid When