This final paper explains in more detail the concept of network digital forensics and its importance in military protocols based on the Internet Protocol. Network forensics analyzes the extraordinary event itself, and it can be an attack by the enemy or the occurrence of a malfunction and some other interference on the network. As in civilian organizations, the armed forces and ministries of defense use technology to simplify the storage and exchange of data. The military has been the target of numerous intrusions and attempts to disrupt the storage and transmission of data, as well as their theft. An attack on a military or state system threatens not only the loss of information as a threat to business and finances, but also a threat to national security. The imperative is to monitor the network in real time, in order to detect possible threats in the shortest possible time, and thus react to them. This paper discusses the application of the Wireshark tool and its implementation in military systems. Methods of analysis of packets sent by the network are presented, and some are applied to a specific example of SQL injection and XSS reflected attack in DWVA local network. In conclusion, the Wireshark tool is useful if it records online traffic all the time, so that in the event of an emergency, a snapshot of the traffic can be analyzed and the nature of the malfunction or possible attack determined.