Wireshark packet analysis: capture, filter and read traffic step by step

Key takeaways

• Capture filters limit what is recorded; display filters limit what you see.
• Follow TCP Stream and the Statistics menu answer most beginner questions.
• Encrypted traffic such as HTTPS shows metadata but not content.
• Practise on public sample captures first.
• Capture only on networks you own or have permission to monitor.

What is Wireshark?

Wireshark is a free packet analyser. It records network traffic and shows each packet broken down by protocol layer. Its documentation is at wireshark.org/docs. Defenders use it to troubleshoot and investigate. Ethical hackers use it to understand what a test generates and what an attacker could see.

Legal note: capturing traffic on a network you do not own or administer, without permission, can break the law. Capture on your own lab or home network.

What is the basic workflow?

1. Pick an interface (Wi-Fi, Ethernet or a VM adapter) and start the capture.
2. Generate some traffic, such as browsing a lab web page or running ping.
3. Stop the capture and save it as a .pcapng file.
4. Filter to the traffic you care about.
5. Inspect the packet detail pane, layer by layer.
6. Follow the stream to read a whole conversation.
7. Note findings with packet numbers.

What is the difference between capture and display filters?

A capture filter is set before you start and limits what is recorded, for example host 192.168.56.101. A display filter is set afterwards and only changes what you see. Display filters are more powerful. Beginners should capture everything on a quiet lab network and filter later.

More on filters in mastering Wireshark filters.

How do you read a conversation?

Right-click a packet and choose Follow, TCP Stream. Wireshark reassembles the data. For an unencrypted lab web server you can read the request and response. This shows why sending credentials over plain HTTP is unsafe.

Which statistics help?

• Statistics, Conversations shows which hosts talk the most.
• Statistics, Protocol Hierarchy shows the protocol mix.
• Statistics, I/O Graph shows traffic over time, useful for spotting bursts.
• File, Export Objects, HTTP lists files transferred in clear text.

Can Wireshark read HTTPS?

Not without the keys. TLS encrypts the content. You still see IP addresses, ports, the server name in some handshakes and traffic volume. In your own lab you can decrypt your own browser traffic by setting a session key log file, as described in the Wireshark documentation.

What is tshark?

Tshark is Wireshark's command-line version, useful on servers and in scripts.

$ tshark -i eth0 -c 100 -w sample.pcapng
$ tshark -r sample.pcapng -Y "dns" -T fields -e ip.src -e dns.qry.name

The first records 100 packets. The second reads the file and prints source IP and queried name for DNS packets.

Where can you practise?

The Wireshark sample captures page hosts public pcap files for many protocols. Download one, open it and answer simple questions: which hosts talked, which protocols appeared, was anything sent in clear text?

What mistakes do beginners make?

• Capturing on the wrong interface and seeing nothing.
• Staring at thousands of packets without a filter.
• Forgetting that a capture can contain passwords and personal data. Store and share it carefully.
• Assuming a suspicious packet proves an attack.

For a gentler start, see Wireshark for beginners.

Next steps

Practise with a trainer in our Computer Network course or the CEH v13 AI course.

Related reading

• What Tools and Technologies Should You Learn to Excel as an Ethical Hacker? The Complete Guide
• What are the most important Wireshark filters every cybersecurity professional should learn?