A Guide to Inspecting Network Traffic Through Wireshark

Whenever you open a browser tab, send an instant message, or play a YouTube video, your computer is sending thousands of communication packets to other computers. That's how internet traffic works! Have you ever wondered what's happening in these data packets? Wireshark is a perfect tool to analyze your network traffic, right on your desktop. You’ll learn not only how to open Wireshark, but also how to properly inspect a packet capture like a seasoned network technician, identify the most frequent snags, and how to write filter expressions that don’t merely intimidate, but actually win you time.

It'll help you troubleshoot different types of network problems. Or, if you are an ethical hacker, it'll enable you to find data leakage on a network. In any case, Wireshark is one of the best network inspection tools.

This tutorial is for beginners, so I'll cover the basics instead of overwhelming you with advanced stuff. Savvy users can build upon the basics to deep dive into this powerful tool. Let's get started!

What Is Wireshark, Exactly?

To put it in simple words, Wireshark is a network protocol analyzer. It's also free to use and is an open-source application. Essentially, it captures the data packets flowing through your computer's network and displays them in a human-readable format for easy inspection and analysis.

Initially, it was released under the name Ethereal way back in 1998. In 2006, the name was changed to Wireshark. In the present day, it has a huge community of developers, supporters, and users.

It's widely used across the world for:

Network troubleshooting
Security analysis and response to incidents
Testing and analysis during protocol development
Study of networking concepts
Performance analysis

Why Should You Even Care About Packet Analysis?

If you are a system administrator, developer, or a tech enthusiast, analyzing error logs and audit trails won't give you the wealth of information packet analysis will give.

Here's where looking at data packets makes sense:

Reasons to inspect data packets — 📷 Why packet analysis is important, sometimes!

Troubleshooting hard-to-detect network issues. Sometimes, the error is so weird that the application logs and system audit trails are not able to pinpoint the issue.
Encryption verification. Developers often use it to ensure the application is actually sending encrypted data or not.
Detecting misconfigured stack. Examples are: Application pointing to the wrong log server, a service listening to the wrong port, etc.
Security audit. To detect issues like suspicious outbound connections or transmitting login credentials in plain text.
Learning network concepts. Students can use it to practically visualize the concepts they're learning through their books.

Is It Legal to Use Wireshark?

Yes, it is, but there's a catch! You must only monitor the network you own or have permission from the network's owner.

If you are capturing traffic on a network you have no authorization for, you are literally violating laws and inviting trouble for yourself. The Wireshark application is perfectly legal to use in the right context.

For troubleshooting and learning purposes, you can use it in the following scenarios:

Analyzing home network traffic.
Capturing traffic originating from your virtual machine.
Monitoring packets of a network for which you have written permission.

Installing Wireshark

Wireshark can be installed on Windows, Linux, and macOS. The installation process is straightforward.

On Windows

Go to Wireshark's official website and download the Windows installer/setup file. A portable version is also available if you prefer that.
Run the setup. During the installation, it'll prompt you to install Npcap, a packet capturing driver Wireshark needs on Windows. Allow that and let the installation process finish.
Start the application. On the first run. it may ask for admin privileges to be able to capture the network traffic.

On macOS

Download the application's .dmg file from Wireshark's official website. Either install through it, or use Homebrew to install from the command line.
```
brew install --cask wireshark
```
Quite similar to Windows, macOS too uses a packet capturing driver. Whenever prompted, grant it permission through the System Settings → Privacy & Security option.

On Linux (Debian/Ubuntu-based)

On Linux too, the installation process is straightforward.

sudo apt update
sudo apt install wireshark

During installation, you’ll be prompted if non-root users are allowed to capture packets on our machine. If you select Yes here, it'll add a new group (wireshark) to the system.

sudo usermod -aG wireshark $USER

For every account you want to give access to Wireshark, you have to add it to this group. This eliminates the need to use sudo repeatedly.

Pro Tip: Do not run Wireshark as a root user on Linux. The packet capturing driver requires elevated privileges to function. It's safe to run it as a normal user.

Your First Capture: A Step-by-Step Walkthrough

Let's start our first packet capture session and get a feel for how things work. Open Wireshark and see the list of available (detected) network interfaces.

Network interfaces list in Wireshark — 📷 List of network interfaces

Step 1: Pick Your Interface

From the list of network interfaces, click the one you want to capture packets from. You'll see a data graph beside the interfaces that are currently carrying traffic.

Step 2: Start the Capture

To start the packet capturing process, either double-click the network interface or simply click the blue Wireshark icon on the top left side. Upon doing so, you'll immediately see the packet capturing activity in real time.

Step 3: Generate Some Traffic

Open a couple of websites in your web browser, and you'll see all types of packet capturing data flowing within the Wireshark interface. This data may contain DNS lookups, TCP handshakes, HTTP or TLS traffic.

Step 4: Stop the Capture

To stop the packet capturing process, either click the red square icon or press the Ctrl + E (On Windows) / Cmd + E (On macOS) key combination. What you are left with is a static snapshot of a packet capturing session.

Step 5: Save It

Use the File → Save As menu option to save this captured data as a .pcapng file at your desired location. You can share it with your peers for offline analysis.

Understanding the Wireshark Interface

At first, the interface may overwhelm you with a constantly scrolling wall of colorful lines and a section of cryptic hexadecimal text. But wait! Once you understand what the three panes in the packet capturing window are all about, everything starts to make sense.

Packet capturing interface in Wireshark — 📷 The packet capturing interface is divided into three parts

1. Packet List Pane (Top)

Each row in this pane is for one packet. Here's what each column means in this pane:

No. - The sequence number of the packet in the capture session.
Time - The time elapsed in seconds since the capture session started.
Source - The IP address from where the packet originated.
Destination - The IP address the packet is destined for.
Protocol - The protocol a packet is following, viz., TCP, UDP, DNS, HTTP, TLS, etc.
Length - The size of the packet in bytes.
Info - A human-readable summary about what’s going on.

The rows are color-coded based on protocols, for e.g., light purple is for TCP, light blue is for UDP, black text on red is for errors, and so on. Through it, experienced users can analyze the packet stream in a much easier way. I'll strongly recommend memorizing all these color codes.

2. Packet Details Pane (Bottom Left)

To inspect an individual packet, click one from the top pane, and this pane will display it layer by layer, following the OSI/TCP-IP model.

Frame - Information about the physical layer.
Ethernet II - Information related to the data link layer.
Internet Protocol - Displays IP addresses from the network layer.
Transmission Control Protocol or User Datagram Protocol - Information like ports, etc are displayed from the transport layer.
Identifies the application layer, for example, HTTP, DNS, TLS, etc.

You can expand each of these header fields to dig deeper.

3. Packet Bytes Pane (Bottom Right)

If you are debugging low-level network issues or investigating malformed packets, this pane shows the packet payload in raw hexadecimal and ASCII form.

Mastering Wireshark Filters (This Is Where the Magic Happens)

By default, a packet capturing session is unfiltered, generating hundreds of records in a short span of time. This can be overwhelming for users. To cut out the noise focusing only on the essentials, you need filters. In Wireshark, filters are of two types:

Capture Filters vs. Display Filters

Feature	Capture Filters	Display Filters
Application context	Before capturing starts	After packets are captured
Syntax	Based on BPF (Berkeley Packet Filter)	Wireshark’s own filter language
Purpose	Reduce what gets recorded	Reduce what gets shown
Mid-capture change	No, requires restarting capture	Yes, anytime
Example	`host 192.168.1.1`	`ip.addr == 192.168.1.1`

If you are a new Wireshark user, focus on display filters as you'll be using them a lot via the filtering bar above the packet stream.

Essential Display Filters to Know

ip.addr == 192.168.1.10

Display packets originating from or destined for a specific IP address.

tcp.port == 443

Display network traffic on port 443, which is usually the HTTPS protocol.

http

Now this one is easy. Displays only HTTP traffic.

dns

Again, a simple one. Displays only DNS queries and responses.

tcp.flags.syn == 1 && tcp.flags.ack == 0

Displays the initial SYN packets of TCP handshakes. It can be used for detecting scan attempts or various connection issues.

tcp.analysis.retransmission

Every packet Wireshark detects as a retransmission is displayed. It generally means a network problem.

!(arp or icmp)

Hide ARP and ICMP packets to reduce clutter and to focus on the essentials.

http.request.method == "POST"

Displays HTTP POST requests. It's a very handy filter while developing web forms or when testing API calls.

Combining Filters

If you are looking to combine multiple filters, use the and/&&, or/||, and not/! connectors. Here's an example:

ip.addr == 192.168.1.10 && tcp.port == 443 && !tcp.analysis.retransmission

This filter displays HTTPS traffic from a specific IP address, dropping the retransmission packets, if any.

Note: If the filter you created is syntactically wrong, the bar will turn red; otherwise it'll be green.

Following the Conversation: TCP Streams

One of the underused Wireshark features is Follow TCP Stream. Right-click a TCP packet and select the Follow → TCP Stream option from the context menu. It'll display the entire conversation between the client and server in human-readable format (choose YAML) that includes requests and responses in a color-coded format.

📷 Following TCP stream in Wireshark in YAML format

It's ideal for:

Analyzing complete request/response stream in one place.
Debugging API calls by analyzing every packet in detail.
Collecting the data (byte by byte) that was sent during the entire request/response cycle.

Do try it once!

Decrypting HTTPS Traffic

Almost 99% of today's internet traffic is encrypted as it runs on the HTTPS protocol. So, when you capture these packets in Wireshark, the payload is all gibberish that we can't understand.

If you want to inspect the encrypted traffic you have permission for, you can use the SSLKEYLOGFILE method. Here's how to do it on Linux or macOS:

Open the terminal, and set an environment variable before opening your web browser:
```
export SSLKEYLOGFILE=~/sslkeys.log
```
Start Chrome or Firefox from this terminal session. Now, these browsers will log all the TLS session keys to the file you just set in the first step.
Open Wireshark and go to the Edit → Preferences → Protocols → TLS option. Select the same file for the '(Pre)-Master-Secret log filename' field.

📷 Configuring TLS (Pre)-Master-Secret log filename in Wireshark
Now you can go ahead with your packet capturing session as usual. Wireshark will now automatically decrypt the TLS session using the logged keys in that file.

Warning: Do not try this for network traffic you do not own or do not have permission for.

Common Beginner Mistakes (And How to Avoid Them)

Let's see some of the common mistakes beginners make while using Wireshark.

Trying to capture traffic on an inactive interface. Simply look at the live traffic graph on the right of each interface. It'll show you all the active interfaces currently passing the traffic.
Not stopping a highly-active capturing session. A highly active packet capturing session may eat a lot of disk space and RAM if continued for a substantial time. As soon as the work is done, don't forget to stop the capturing session. The best strategy is to apply capture filters before the session starts.
Struggling between capture and display filters. Using capture filter syntax for a display filter will generate an error. Thoroughly learn the basics of both filter types and apply accordingly.
Not paying attention to the color coding. If you notice black rows with red text in the stream, do not ignore them. Similarly, learn to identify protocols through color codes.
Presuming Wireshark will automatically decrypt HTTPS packet payloads. Nope! For that, you have to configure the TLS session keys file as explained in the previous section.

Best Practices for Efficient Packet Analysis

Following these best practices will help you get more out of this powerful network monitoring tool:

Decide the goal and filter right from the beginning. First ask yourself, what are you going to monitor? Then, accordingly, first create a capture filter, followed by different display filters during the packet capturing session.
Save capturing profiles for reuse. Under the Edit → Configuration Profiles option, save the frequently used filter and column setup to reuse it easily in the future.
Always give meaningful names to the saved capture files. For example:
- A file name capture3456.pcapng makes no sense.
- A file name dns-timeout-issue-office-router-2026-05-06.pcapng explains everything.
Always capture legitimate data and use this tool responsibly. Whether it's your home or office, think twice before starting a capturing session.

Conclusion

Wireshark, at the very start, feels like learning a completely new language: full of acronyms, headers, and hex dumps that look like pure white noise. But once the basic principles have fallen into place, you'll start to see how your network actually functions as opposed to how it should function conceptually. This difference is the key to gaining real troubleshooting ability.

Start small. Take a snapshot of yourself browsing. Follow the TCP Stream of this traffic.

Filter for DNS traffic and observe just how many DNS requests are generated by a single webpage visit. Once you start poking around, the interface feels less alien and much more like a power tool.