Network Scanning with Nmap and Traffic Analysis Using Wireshark
Learn how to use Nmap, Wireshark, and Dumpcap to scan networks, analyze packet traffic, and troubleshoot connectivity issues. I use these tools for network diagnostics, security assessments, and validating infrastructure deployments.
Overview
Nmap and Wireshark are two of the most widely used network analysis tools for security testing, troubleshooting, and infrastructure monitoring. Nmap helps identify active hosts, open ports, operating systems, and running services, while Wireshark captures and analyzes network traffic in real time.
In this guide, I demonstrate how to perform common network scans with Nmap, inspect packet traffic using Wireshark, and capture network data using Dumpcap for advanced troubleshooting.
Why Use Nmap and Wireshark?
Together, these tools provide valuable insights into network behavior, helping administrators and security professionals identify vulnerabilities and diagnose connectivity issues.
Key Benefits
- Discover active hosts
- Identify open ports
- Detect running services
- Perform operating system detection
- Analyze packet traffic
- Troubleshoot network issues
- Validate firewall configurations
- Support security assessments
Installing the Tools
Install Nmap
Install Nmap on your preferred operating system.
sudo apt update
sudo apt install nmap -yWindows users can download the installer directly from the official Nmap website.
Install Wireshark
Install Wireshark together with Dumpcap for packet capture and analysis.
sudo apt update
sudo apt install wireshark -yBasic Nmap Scans
Nmap provides multiple scan types depending on the information you want to collect.
Scan a Single Host
Scan a single IP address for open ports.
nmap 192.168.1.100Scan a Network Range
Discover active devices within a subnet.
nmap 192.168.1.0/24Detect Running Services
Identify services and software versions running on open ports.
nmap -sV 192.168.1.100Operating System Detection
Attempt to identify the target operating system.
sudo nmap -O 192.168.1.100Understanding Scan Types
SYN Scan
The SYN Scan (Stealth Scan) sends a SYN packet without completing the TCP handshake.
Advantages:
- Faster scanning
- Less detectable
- Commonly used during security assessments
sudo nmap -sS 192.168.1.100TCP Connect Scan
Performs a complete TCP handshake before closing the connection.
Advantages:
- Highly reliable
- Does not require raw socket privileges
- Useful when SYN scans are unavailable
nmap -sT 192.168.1.100Traffic Analysis with Wireshark
Wireshark allows captured packets to be filtered and analyzed in real time.
Common filters include:
- TCP SYN packets
- SYN-ACK responses
- Reset packets
- Specific IP addresses
- Specific protocols
These filters help visualize how Nmap scans interact with network devices.
Capturing Network Traffic
Start a packet capture using your preferred network interface.
Apply filters to isolate specific traffic patterns during scanning.
Examples include:
- SYN packets
- ACK packets
- TCP conversations
- HTTP traffic
This makes troubleshooting significantly easier.
Using Dumpcap
Dumpcap is Wireshark's lightweight packet capture utility designed for long-running captures and automated monitoring.
It supports:
- Ring buffer captures
- Scheduled packet captures
- Low resource usage
- Large capture files
This makes it ideal for production troubleshooting.
Wireshark Filter — SYN Packets
Displays TCP SYN packets that initiate new connections (excluding SYN/ACK responses).
tcp.flags.syn == 1 && tcp.flags.ack == 0Wireshark Filter — SYN/ACK
Displays TCP packets with both SYN and ACK flags set.
tcp.flags.syn == 1 && tcp.flags.ack == 1Wireshark Filter — RST Packets
Displays TCP reset (RST) packets.
tcp.flags.reset == 1Filter by IP Address
Displays traffic to or from a specific IP address.
ip.addr == 192.168.1.100Capture Traffic with Dumpcap
Captures packets on eth0 using a rotating capture buffer.
dumpcap -i eth0 \ -b filesize:100000 \ -b files:10 \ -w capture.pcapCommon Use Cases
These tools are commonly used for:
- Network auditing
- Vulnerability assessments
- Firewall testing
- Security monitoring
- Packet analysis
- Incident response
- Performance troubleshooting
- Infrastructure validation
Why I Recommend These Tools
For infrastructure and freelance projects, I regularly use Nmap and Wireshark to verify network configurations, troubleshoot connectivity issues, and validate service availability before deployment. Combined with Dumpcap, they provide a complete toolkit for diagnosing network behavior while supporting security testing and operational monitoring.
Conclusion
Nmap and Wireshark remain essential tools for network administrators, cybersecurity professionals, and developers. Together they provide comprehensive visibility into network services, traffic, and communication patterns, making them invaluable for troubleshooting, security testing, and infrastructure management.
