Wireshark is the standard GUI tool for packet analysis. It captures traffic and displays it in human-readable format.
Display filters:
ip.addr == 192.168.1.100
tcp.port == 80
http.request
tcp.analysis.retransmission
Analysis features:
- Follow TCP streams to see conversations
- Expert Info highlights anomalies
- Statistics show protocol distribution
Quick wins:
- Filter for retransmissions to find packet loss
- Check time between request and response for latency
- Look for RST packets indicating refused connections