If you would like to see this - check out our video:įirst there is the generic find/search capability in Wireshark that is found here: Anything in the tunnel will be and therefore not searchable.Īlright, let's talk about what tools come in Wireshark to find a string. Most packet headers outside such a tunnel are always searchable and not encrypted. If you are looking for a string in the packet headers, it will depend on whether the header was inside or outside a VPN tunnel. However, if they are using HTTP or some other clear text protocol, then you will be able to find a string in the packet contents. If you are looking for something like 'password' in the contents of packets, and the user was on an HTTPS connection, then you will not find this string. packet content) and if the packets contain encrypted data. The answer is that it depends on where the text string is (like header vs. Our Udemy course on Wireless Packet capture Our custom profiles repository for Wireshark 5 of 5 - 4 votes Thank you for rating this article.Ī common question regarding Wireshark packet analysis is 'Can I find a text string in a packet capture?'Ĭheck out these great references as well:

Compare two wireshark captures