Wireshark is the world's most widely used network protocol analyzer — free, open source, and standard equipment for network engineers and security professionals. It captures the packets flowing through your own network interface and displays them in readable form. This guide teaches legitimate uses: understanding your own traffic, diagnosing your own network issues, and learning how protocols work.
What Wireshark Shows You
Every email sent, every page loaded, every video streamed is broken into packets — small envelopes of data with source, destination, and contents. Wireshark captures these envelopes as they pass your own computer's network card and decodes them: "this packet is part of a web page load," "this one is a DNS lookup for example.com." Watching real traffic makes abstract networking concepts concrete.
Installing Wireshark
Download only from the official wireshark.org site. On Windows the installer includes Npcap (the capture driver) — accept it. On Linux: sudo apt install wireshark (add your user to the wireshark group to capture without root). On macOS, install via the official disk image. During setup you will be asked about capture permissions — grant them only for your own learning use.
Your First Capture (Your Own Traffic)
- Open Wireshark. You will see a list of your computer's network interfaces.
- Double-click your active interface (WiFi or Ethernet) to start capturing your own computer's traffic.
- Open a website in your browser, then return to Wireshark and click the red square to stop.
- You now have a list of packets your own computer sent and received. Click any packet to see its decoded layers — Ethernet, IP, TCP/UDP, and the application data.
Filtering: Finding the Signal
Real captures contain thousands of packets. The display filter bar is your most important skill:
dns— show only DNS lookups (what names your computer resolved).http— show HTTP traffic.ip.addr == 192.168.1.1— traffic involving your own router.tcp.port == 443— encrypted web traffic.
Try this exercise on your own capture: filter dns and see every website your computer looked up while you browsed. Eye-opening — and entirely your own data.
Legitimate Things to Learn From Your Own Traffic
- Which apps "phone home": filter by your phone's or PC's traffic and see what background connections your own software makes — great for privacy awareness.
- Diagnosing your own issues: slow connection? Capture while it happens and look for retransmissions and DNS delays.
- Protocol learning: watch a TCP handshake (SYN, SYN-ACK, ACK) happen live — textbooks cannot compete.
- Checking encryption: confirm your banking and email actually use TLS (look for the TLS handshake, not readable content).
What You Must NOT Do
- Never capture traffic on networks you do not own or administer — intercepting others' communications is illegal in most countries, even "just looking."
- On shared or public networks, capture only with explicit written authorization (e.g., your employer's network as part of your job, with approval).
- Encrypted traffic (HTTPS) is unreadable by design — tools claiming to "decrypt others' traffic" are either scams or attack tools. Do not go there.
Following a TCP Stream (Your Own Traffic)
Right-click any TCP packet from your own browsing session and choose Follow → TCP Stream. Wireshark reconstructs the entire conversation — you will see your browser's request and the server's response as readable text (for unencrypted HTTP on your own lab server). This is the single best way to understand what "a web request" actually is. Try it against your own lab web server running plain HTTP, then compare with an HTTPS site where you will see only encrypted gibberish — a visceral lesson in why encryption matters.
Statistics: Seeing Patterns
Wireshark's Statistics menu reveals patterns invisible in packet lists: Protocol Hierarchy shows what share of your traffic is DNS, TCP, UDP; Conversations lists who talked to whom and how much; IO Graphs plot traffic over time — spikes correlate with that video call or download. On your own network, these views answer "what is my network actually doing?" faster than any dashboard.
Capture Filters vs. Display Filters
Beginners should know the difference: capture filters (set before capturing, e.g., port 80) decide what gets recorded — unrecorded traffic is gone forever. Display filters (the main bar) only hide/show from an already-complete capture. Rule of thumb: capture broadly on your own interface, filter narrowly afterward. Disk is cheap; missed packets are not recoverable.
Useful Display Filters Cookbook (Your Traffic)
dns.qry.name contains google— DNS lookups involving google.http.request.method == "POST"— form submissions from your own browsing.tcp.analysis.retransmission— retransmitted packets, a sign of network trouble on your own connection.dhcp— watch your own device get its IP address when joining WiFi.arp— address resolution chatter on your own LAN.
Save filters you reuse (right-click the filter bar → save). A personal cookbook of filters is a working analyst's treasure.
Exporting Evidence From Your Own Captures
File → Export Objects → HTTP lets you save files transferred in your own capture — handy for analyzing what your own lab server sent. Statistics → Protocol Hierarchy exports nicely into reports. And remember: capture files can contain sensitive data (even your own), so store them securely and delete when done. Professionals treat pcaps like evidence — because they are.