Wireshark Tutorial for Beginners: Install, Capture and Read Your First Packets

Key takeaways

• Wireshark is free and open source, and it works on Windows, macOS and Linux.
• Capture filters limit what is recorded. Display filters limit what you see. Beginners mix these up.
• Three filters get you far: a protocol name (dns, http, tls), ip.addr == x.x.x.x, and tcp.port == n.
• Capture only on your own network or with written permission. Unauthorised sniffing is illegal under India's IT Act.
• HTTPS payloads are encrypted, so you will see handshakes and metadata, not page content.

What is Wireshark used for?

Wireshark records the packets crossing a network interface and breaks each one into protocol layers: Ethernet, IP, TCP or UDP, then the application protocol. Network engineers use it to find why something is slow or failing. Security analysts use it to inspect suspicious traffic. Students use it to see how DHCP, DNS and TCP really work. Full documentation is on the Wireshark docs site.

How do you install Wireshark?

1. Download the installer for your system from the official Wireshark website.
2. On Windows, accept the packet capture driver (Npcap) when the installer offers it.
3. On Debian-based Linux such as Kali or Ubuntu, install with sudo apt install wireshark. When asked whether non-superusers may capture packets, choose yes, then add yourself to the group with sudo usermod -aG wireshark $USER and log in again.

Running the whole GUI with sudo wireshark works but is not good practice, because the large dissector code then runs as root. Giving capture rights to a group is safer.

How do you capture your first packets?

1. Open Wireshark. The start screen lists interfaces (Wi-Fi, Ethernet, loopback). The one with a moving graph line is active.
2. Double-click the interface to start capturing.
3. In a browser, visit a site or run ping example.com in a terminal.
4. Click the red square to stop. Save with File, Save As if you want to keep it.

How do you read the Wireshark window?

There are three panes. The packet list shows one row per packet with number, time, source, destination, protocol, length and a summary. The packet details pane shows the layers of the selected packet, which you can expand. The packet bytes pane shows the raw hexadecimal and ASCII. Colour rules help: for example, TCP problems and resets stand out.

What is the difference between a capture filter and a display filter?

A capture filter is set before you start and tells the capture library which packets to record at all, for example host 192.168.1.10 or port 53. It uses BPF syntax. A display filter is typed in the green bar after capture and only hides packets from view, for example dns or ip.addr == 192.168.1.10. Display filters are more powerful and reversible, so beginners should capture broadly and filter on screen.

For a bigger set, see our Wireshark filters guide.

Exercise: watch a DNS lookup and a TCP handshake

1. Start a capture, then run nslookup example.com.
2. Apply the filter dns. Find the query and the response. Expand the response and read the answer record.
3. Now open a website and clear the filter. Find a packet with SYN, then SYN-ACK, then ACK. That is the three-way handshake.
4. Right-click a TCP packet and choose Follow, TCP Stream to see one conversation as a whole.

Write down what you saw in your own words. That note is the study value of the exercise.

What can Wireshark not show you?

HTTPS and other encrypted traffic is unreadable without keys, so you see the TLS handshake, server names in some cases, timing and sizes, not the page. On switched networks you see only your own traffic plus broadcast and multicast unless you use a mirror (SPAN) port on equipment you control. Wi-Fi capture needs a monitor-mode adapter.

Is it legal to use Wireshark on any network?

No. Capture on your own devices, your home or lab network, or a network where you have written authorisation. Capturing other people's traffic without permission can breach India's IT Act and privacy law. Packet captures also contain sensitive data, so store and share them carefully.

Common beginner mistakes

• Capturing on the wrong interface and seeing nothing.
• Typing a display filter in the capture filter box (syntax differs).
• Expecting to read HTTPS bodies.
• Capturing for hours and creating a file too large to open. Use a ring buffer or stop sooner.

Next steps

To go further, read Wireshark packet analysis for ethical hacking. WebAsha's CCNA training gives you the networking background that makes captures easy to read.

Related reading

• What are the best Wireshark filters for OT cybersecurity monitoring and threat detection?
• Understanding Man-in-the-Middle Attacks: A Step-by-Step Guide Using Bettercap