How to analyze industrial network packets using Wireshark

The invisible challenge of factory floor communication

Unlike a conventional office network where traffic consists mostly of web browsing and video calls, the industrial network operates under strict real-time constraints. Devices such as Programmable Logic Controllers (PLCs), HMIs, and variable frequency drives talk to each other within fractions of a millisecond. When an intermittent failure occurs, relying solely on equipment status LEDs is usually insufficient to reveal the root cause. This is where Wireshark comes in, an open-source network protocol analyzer capable of capturing and inspecting every single bit traversing the cables.

In practice, analyzing an industrial network means looking at raw data flows as if translating a whispered conversation in a noisy room. Each message exchanged between a sensor and an actuator serves a strict purpose, structured according to rigorous automation standards. Understanding the anatomy of these packets prevents guesswork-based troubleshooting, allowing engineers and technicians to identify bandwidth bottlenecks, physical instabilities, and anomalous behaviors before they cause catastrophic production shutdowns.

Setting the stage: traffic access with port mirroring

The first practical obstacle when using Wireshark in industrial environments is the physical isolation provided by modern switches. In older corporate networks, repeating hubs broadcast traffic to all ports, making passive eavesdropping easy. Today, managed switches direct data only to the correct recipient for security and bandwidth efficiency reasons. To bypass this without interrupting factory operations, we configure a feature known as port mirroring, or SPAN (Switched Port Analyzer).

In practice, SPAN instructs the switch to copy all traffic passing through a critical port—connected to a main PLC, for example—and forward it to an extra port where the laptop running Wireshark is connected. If the plant utilizes legacy equipment or fiber optic ring networks, special adapters called optical or electrical network TAPs can be inserted transparently into the cabling. This approach ensures that the analysis tool receives an exact copy of all packets without interfering with the integrity or determinism of control signals.

Unlocking automation protocols: the Modbus TCP case

Once packet capture is active, Wireshark's screen fills with colorful lines representing hundreds of frames per second. Without proper knowledge of industrial protocols, this sea of hexadecimal data looks undecipherable. Take Modbus TCP as an example, one of the most popular protocols in the industrial world, built upon traditional Ethernet and TCP/IP ecosystems. It typically operates on port 502 and uses a simple request-response model between client and server.

By filtering traffic typing modbus in Wireshark's search field, the tool automatically separates and translates the complex packet fields. Instead of reading isolated hexadecimal numbers, the engineer can see clear commands like "Read Holding Registers" or "Write Single Coil." In practice, this allows verification of whether the PLC is actually sending the correct command to start a conveyor belt and if the inverter is responding with the proper status code or emitting an overcurrent alarm.

Applying advanced filters to isolate communication failures

The volume of data generated on a busy industrial network can overwhelm even the most experienced analyst. Leaving Wireshark capturing packets for a few minutes results in tens of thousands of records, making manual searches for an error akin to finding a needle in a haystack. To isolate the problem, the operator must master the software's filtering language, combining IP addresses, logical ports, and protocol identifiers.

If packet loss is suspected on a specific device, we can apply a filter based on the equipment's IP address combined with TCP retransmission analysis, using the expression tcp.analysis.retransmission. In practice, a high number of retransmissions indicates physical link layer issues, such as poorly crimped RJ45 connectors, cables running too close to high-power motors generating electromagnetic interference, or packets corrupted by severe electrical noise on the shop floor.

Interpreting jitter and latency in real-time networks

Modern industrial networks, such as Profinet IRT, EtherCAT, or Ethernet/IP with CIP Sync connections, rely on millimetric temporal synchronization among network nodes. A delay of just a few microseconds in delivering a control packet can misalign robot axes in an automated welding line. Wireshark features native statistical analysis tools that help measure response time between sending a request and the arrival of the respective response.

By selecting a TCP or UDP stream and opening the I/O graph or round-trip time analysis tool, the analyst visualizes the temporal network behavior in graphical format. In practice, latency spikes that coincide with triggering a heavy load in another factory sector reveal voltage drop issues or lack of proper shielding in communication cables, guiding the maintenance team toward physical correction of structured cabling.

Conclusion and best practices in industrial packet inspection

Packet analysis with Wireshark transforms industrial network troubleshooting from a guessing game into an exact science. By mastering port mirroring techniques, advanced filtering, and protocol interpretation for Modbus, Profinet, and Ethernet/IP, engineers gain autonomy to diagnose complex faults in minutes, drastically reducing machine downtime. Keeping network maps updated and performing periodic traffic audits ensures not only operational stability but also raises cybersecurity levels against unauthorized access on the factory floor.

Ultimately, the tool is only as efficient as the knowledge of the operator. Integrating traffic inspection habits into preventive maintenance routines strengthens the resilience of the entire automation infrastructure. With patience, method, and the visual support provided by Wireshark, invisible network traffic ceases to be a mystery and becomes an open book regarding the health of industrial processes.