TechKnowSurge
Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.6 Cisco CyberOps Associate 4.7 CompTIA Network+ 5.5
TechKnowSurge Catalog Videos Sorting Data
VideoNetworkFree

Sorting Data

Modern networks generate enormous volumes of captured traffic, making it essential to sort packet data by protocol, source, destination, or time to isolate what matters. This content covers how to use Wireshark's column-based sorting to quickly group and analyze specific traffic types.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Every network capture session has the potential to collect thousands of packets within seconds, because modern operating systems and applications constantly generate background traffic for update checks, connectivity verification, and service discovery. Without a way to organize that volume of data, identifying meaningful patterns or isolating a specific conversation becomes impractical. Sorting is one of the most immediate tools available for bringing order to a raw capture and directing attention toward traffic that warrants closer analysis. Wireshark's column-based sorting allows analysts to reorder packet data by protocol, source IP, destination IP, time, or packet number with a single click on any column header. Clicking a header again reverses the sort order between ascending and descending, making it straightforward to group all TCP traffic together, trace every packet originating from a specific host, or examine all traffic directed at a target server. This flexibility means analysts can pivot quickly between different views of the same capture without applying filters or modifying the underlying dataset, keeping the workflow efficient during both routine monitoring and active incident investigation.

What you'll learn

What's covered

Wireshark Sorting

Aligned to

Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark
4.7 Identify key elements in an intrusion from a given PCAP file
CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues

Key terms

Protocol
A set of rules governing the format and transmission of data between devices.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Wireshark
Wireshark is an open-source network protocol analyzer that captures and interactively displays packet-level traffic, used by security professionals for network forensics, vulnerability research, and incident investigation.

Topics

Wireshark Packet Analysis Network Traffic Network Forensics Packet Capture Networking

Transcript

Why we need to sort

When we're capturing data we could end up with a ton of data. Networks nowadays are really chatty and there's a lot of information going back and forth. Even just turning on a computer is going to generate a lot of traffic on a network, because Windows and other programs are out there looking for updates and seeing what they need to do, and do they have an internet connection, and those types of things. So what we want to do is be able to filter and sort to find the data that we are going to want to use.

Sorting a capture

Here we've already got some data that's captured in here. What I'm going to do is scroll down, and maybe I'm most concerned with this web traffic. I want to see what's happening from a TCP standpoint. So what I can do is select this and go through this, but I don't know if there's other communication that's happening with this that I want to see. I want to see just all of the TCP traffic.

So what I can do is select anywhere, select one of these TCP, and hit protocol, and it's going to sort by the protocol. So now I've got all the TCP grouped up and I can see everything that's happening with TCP, as well as if I want to look at SDP or any of these other protocols. Now I have them all sorted by protocol, and it's sorted alphabetically from first letter to last letter, or I could reverse that and have it reversed now. So that's the protocol sort.

I can also do it by source, if I want to see everything that's coming from this 10.1.1 10.34 address. Now I can see that, and what the destinations are going to be. Or maybe I want to sort by destination and see everything that's going to that web server and see what that looks like. Or maybe I want to sort it back towards the time or the packet number.

So now I can click on this. I can click on any one of these columns to sort this by, and then if I click it again then it will reverse sort it. So from least to greatest, or from greatest to least. That is the sort function.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →