Wireshark  is a powerful packet sniffer and network protocol analyzer used by SOC analysts to capture and inspect network traffic. It allows for detailed inspection of packets, providing insight into data flows, network performance, and potential security threats. Analysts can filter traffic, identify abnormal patterns, and examine the contents of packets to detect malware, unauthorized access, or unusual activity.

Real-world application:

A SOC analyst uses Wireshark to investigate a suspected data breach in an organization. By capturing and analyzing network packets, the analyst identifies unusual outbound traffic to an external server, which turns out to be a malicious exfiltration of sensitive data. Wireshark’s detailed view of the packet contents helps the analyst pinpoint the source of the breach and take corrective action, such as blocking the compromised server.