Table of Contents
Getting Started With Wireshark
Wireshark is a graphical tool that lets you see what is actually happening on a network, packet by packet. It is one of the most important tools for network troubleshooting and learning, because it shows you the real traffic instead of just summaries or statistics.
This chapter focuses on how to use Wireshark effectively, especially in combination with other tools from this section. It assumes that you already understand basic ideas such as packets and layers from earlier chapters, and that packet analysis will be explored in more depth in the dedicated Packet Analysis chapter.
Installing and Launching Wireshark
Wireshark is available for Windows, macOS, and many Linux distributions. During installation on desktop systems you usually need two components: the Wireshark application itself and a capture driver that allows the system to capture packets.
On Windows, this capture driver is typically npcap. On Linux, packet capturing is usually provided by the operating system through libpcap. On macOS, Wireshark uses similar underlying libraries and may need special permissions to capture on physical interfaces.
To capture real traffic, Wireshark often needs elevated privileges. On Windows this usually means running Wireshark as a user with administrative rights. On Linux, you can either run Wireshark with sudo or configure permissions so that regular users can capture safely. On macOS, you may need to grant additional security permissions.
Once Wireshark is installed, you can start it like a normal application. At startup, Wireshark shows you a list of available network interfaces, along with basic activity indicators that show which interfaces are currently seeing traffic.
Choosing Interfaces and Starting a Capture
Before you capture any traffic, you must choose the correct interface. A system with only one wired network card is straightforward, but laptops with wired, wireless, virtual, and VPN interfaces can show many options.
Typical interface types include physical Ethernet ports, Wi‑Fi interfaces, loopback interfaces, VPN tunnels, and virtual interfaces that belong to virtual machines or containers. Wireshark displays traffic counters for each interface, so a useful first step is to observe which one shows increasing packet activity that matches what you expect.
To start a capture, select an interface and click the start capture button. From that moment Wireshark begins recording every packet it can see on that interface, subject to any capture filters you might have applied. If you are troubleshooting a specific problem, such as a failed web access, it is usually best to start the capture, reproduce the problem, then stop the capture quickly so that the file does not become enormous.
Capture Filters vs Display Filters
One of the most important ideas in Wireshark is the difference between capture filters and display filters. They solve different problems and are used at different times.
Capture filters are applied before packets are saved. They limit which packets Wireshark will actually record. Display filters are applied after capture to control which of the recorded packets are shown in the main window.
A capture filter is helpful when you already know what you want to record and you want to avoid large capture files. A display filter is more flexible for exploring and troubleshooting because you can change it as many times as you like without needing to capture again.
Capture filters use a syntax inherited from libpcap. For example, you might capture only traffic to a server on port 80. Display filters use Wireshark’s own protocol oriented syntax. For example, you might show only HTTP packets or only packets with a certain IP source address.
Capture filters decide what is stored. Display filters decide what you see.
Because capture filters cannot be undone, beginners usually rely more on display filters while learning, and keep capture filters simple or avoid them at first.
Understanding the Wireshark Interface
Wireshark’s main window has three core areas that you will use constantly: the packet list, the packet details, and the packet bytes view.
The packet list sits at the top. Each row is one packet and shows timestamp, source, destination, protocol, length, and brief info. This area is where you see the overall flow of traffic. You can sort by any column, which is useful to group packets by source, destination, or protocol during troubleshooting.
The packet details pane displays a decoded view of the currently selected packet, broken down by layers, such as frame, Ethernet, IP, and transport or application protocols. You can expand and collapse each layer to see its fields. This pane is essential when you want to read specific header values, such as TCP flags, port numbers, or HTTP status codes.
The packet bytes view shows the raw bytes of the packet in hexadecimal and ASCII. For beginners, it mainly serves as a reference to connect the human friendly decoding with the underlying raw data. It also becomes important when investigating application payloads, binary protocols, or when verifying exact message contents.
Wireshark also has menus and toolbars for starting and stopping captures, loading and saving files, applying filters, and using built in analysis tools. While the interface has many options, day to day troubleshooting focuses on starting a capture, using filters, selecting packets, and reading header fields in the middle pane.
Using Display Filters for Troubleshooting
Display filters are where Wireshark becomes truly powerful as a troubleshooting tool. A display filter lets you focus on the packets that matter for your current question.
Display filters are protocol aware. Instead of writing low level expressions, you reference protocol names and field names. A simple filter to show only HTTP traffic is:
Example display filter: http
You can filter by IP addresses:
ip.addr == 192.168.1.10
This shows packets where either the source or destination IP is 192.168.1.10. If you want only packets from that address, you can write:
ip.src == 192.168.1.10
To filter by TCP or UDP port, you can use fields like tcp.port, tcp.dstport, udp.port, or udp.srcport. For example, to see all traffic destined to port 443:
tcp.dstport == 443
You can combine filters with logical operators. For instance, to show only packets that are both TCP and have a specific destination port:
tcp && tcp.dstport == 80
Or to show traffic between two specific hosts:
ip.addr == 10.0.0.1 && ip.addr == 10.0.0.2
Display filters are very helpful when you jump from simple checks with ping or traceroute to deeper inspection. For example, if ping shows intermittent loss to a host, you can capture packets and filter by that IP to see whether ARP, DNS, or TCP handshakes are failing.
Following TCP and UDP Streams
When you examine a single packet, it is often just a tiny part of a longer conversation. Wireshark can reconstruct a conversation into a readable sequence, which is particularly useful for TCP based protocols.
The “Follow TCP Stream” feature gathers all packets that belong to one TCP connection and displays the payload in order, separated by client and server. This turns a complex sequence of packets into a readable dialogue. For example, if you troubleshoot an HTTP request, following the TCP stream lets you see the full request headers and response content. It can help you find application errors such as wrong URLs, missing headers, or authentication failures.
Similarly, “Follow UDP Stream” can group packets that belong together logically when the application uses UDP. Although UDP has no built in notion of connection, Wireshark uses address and port combinations to approximate a stream.
These follow stream features are very helpful for troubleshooting issues that basic tools such as ping cannot expose. When a server returns unexpected responses or a client sends incorrect data, following the stream allows you to compare what you expect with what is really sent.
Using Coloring Rules to Spot Problems
Wireshark uses color to highlight certain packet types so you can visually spot patterns and problems. By default, different protocols and events appear in different colors. For example, TCP retransmissions or duplicate acknowledgements might be highlighted in specific shades.
Coloring rules operate on display filter expressions. If a packet matches the rule’s filter, Wireshark applies the associated color to the row in the packet list. This makes it easier to find anomalies within a long capture.
You can view or edit coloring rules through the Wireshark menus. As you gain experience, you might create your own rules to highlight traffic relevant to your environment, such as certain IP ranges, management protocols, or error conditions.
Coloring does not affect which packets are captured or which are visible. It is purely a visual aid. For troubleshooting, colored rows can quickly draw attention to retransmissions, resets, or other indicators of performance or connectivity problems.
Saving, Loading, and Sharing Captures
Wireshark saves captured packets in pcap or pcapng formats, which are widely supported by other tools such as tcpdump. Saving captures is important when you need to analyze later, compare before and after states, or share traces with colleagues or support teams.
It is good practice to stop captures as soon as you have captured the relevant behavior. This keeps file sizes manageable and reduces the amount of unrelated information you need to sift through. You can also use the “Export Specified Packets” feature to save only a selection of interest, based on display filters or manual selection.
When you share capture files, be aware that they might contain sensitive data. Packets can reveal hostnames, IP addresses, protocol details, and sometimes even application content. Before sending a capture outside your organization, consider whether to anonymize addresses or remove payloads. Wireshark provides features that can help mask or remove some information, although for full sanitization you might need additional tools or strict capture strategies.
Integrating Wireshark With Other Troubleshooting Tools
Wireshark is most effective when used along with other tools from this section. For example, if ping fails, you can capture traffic during the ping attempt and inspect ARP and ICMP packets to see where the communication breaks. If traceroute shows an unexpected path or stops at a certain hop, you can capture on the relevant interface and analyze TTL values and ICMP responses.
In combination with netstat, you can see which local ports are open or in use, and then use Wireshark to observe the actual traffic for those connections. Tcpdump can capture packets on remote systems with limited resources, and the resulting pcap files can be transferred and opened in Wireshark for detailed analysis.
This workflow allows you to perform lightweight captures in the field, then use Wireshark’s rich graphical environment to investigate timelines, flags, payloads, and protocol behavior.
Common Beginner Workflows
For beginners, a small set of workflows covers most typical tasks. One common workflow is debugging web access. You start Wireshark on the interface that connects to the network, apply a display filter such as http or tcp.port == 80 and tcp.port == 443, reproduce the problem in the browser, then observe the TCP handshake, DNS queries, and HTTP requests and responses.
Another typical workflow is analyzing a failed connection. You begin the capture, try to connect from a client to a server, then stop the capture and filter by the server IP. You look for ARP requests and replies, TCP SYN, SYN/ACK, and ACK, or any ICMP error packets. This helps you decide whether the problem is at the network layer, transport layer, or application layer.
A further common use is investigating performance complaints. By capturing and then applying filters to identify retransmissions, out of order packets, or large response times between request and response, you can distinguish network path issues from application latency.
These workflows are entry points. Deeper techniques such as detailed protocol decoding and timing analysis will be covered in the Packet Analysis chapter, but Wireshark is the central tool that enables all of them.
Legal and Ethical Considerations
Using Wireshark has important legal and ethical implications. Packet captures can reveal private user activity, authentication tokens, and other sensitive data. You should only capture traffic on networks where you are authorized, and only for purposes that comply with your organization’s policies and applicable laws.
On shared networks, you should be careful to limit captures to the scope needed for troubleshooting. Use filters and short capture windows to reduce exposure. Do not share capture files casually, especially if they might contain confidential information.
Being careful about authorization and privacy is a fundamental part of professional use of Wireshark and other monitoring tools.
Summary
Wireshark allows you to see network conversations in detail, from individual packet headers to complete application flows. By choosing the correct interface, understanding capture and display filters, reading the main panes, following streams, and combining Wireshark with simpler tools such as ping, traceroute, netstat, and tcpdump, you gain a powerful way to diagnose and understand network behavior. The skills you learn here provide the foundation for more advanced packet analysis techniques that you will explore later in the Packet Analysis chapter.