What Is Wireshark

Wireshark is the world's most widely used network protocol analyzer. It lets you capture live network traffic and inspect it at a granular level -- down to individual packets and the bytes within them. Network administrators use it to troubleshoot connectivity issues, security professionals use it to investigate suspicious activity, and developers use it to debug application protocols.

Wireshark is open-source, cross-platform, and completely free. It supports hundreds of protocols and can read capture files from many other tools, making it the de facto standard for network analysis.

Installing Wireshark

Wireshark is available in the default repositories of most Linux distributions and can be downloaded directly for Windows and macOS.

Ubuntu / Debian

# Install Wireshark
sudo apt update
sudo apt install wireshark

# During installation, select "Yes" when asked whether
# non-superusers should be able to capture packets

After installation, add your user to the wireshark group so you can capture packets without running as root:

# Add your user to the wireshark group
sudo usermod -aG wireshark $USER

# Log out and log back in for the group change to take effect

Fedora / RHEL

sudo dnf install wireshark wireshark-qt
sudo usermod -aG wireshark $USER

Windows

Verify the installation by opening Wireshark. You should see a list of available network interfaces on the welcome screen.

Capturing Packets

Capturing is the core function of Wireshark. You select a network interface, start the capture, and Wireshark records every packet that passes through that interface.

Selecting an Interface

When you open Wireshark, the welcome screen displays all available network interfaces along with a small sparkline graph showing current activity on each one. Choose the interface that carries the traffic you want to analyze:

Starting and Stopping a Capture

You can also capture from the command line using tshark, the terminal-based companion to Wireshark:

# Capture 100 packets on eth0 and save to file
tshark -i eth0 -c 100 -w capture.pcapng

# Capture with a display filter (HTTP traffic only)
tshark -i eth0 -Y "http" -c 50

Saving Captures

Save your capture for later analysis using File > Save As. Wireshark defaults to the .pcapng format, which supports annotations and multiple interfaces. You can also export as the older .pcap format for compatibility with other tools.

Display Filters

A busy network can produce thousands of packets per second. Display filters let you narrow down the packet list to only the traffic you care about. The filter bar is located at the top of the main window -- type a filter expression and press Enter.

Essential Display Filters

Combining Filters

You can combine multiple conditions using logical operators:

# Traffic from a specific IP on port 80
ip.addr == 192.168.1.100 && tcp.port == 80

# DNS or HTTP traffic
dns || http

# All traffic except ARP broadcasts
!arp

# TCP traffic from a subnet
ip.src == 10.0.0.0/24 && tcp

The filter bar turns green when the syntax is valid and red when there is an error. Wireshark also provides autocomplete suggestions as you type.

Following TCP Streams and Color Coding

One of Wireshark's most powerful features is the ability to reconstruct and view an entire TCP conversation between two hosts.

Following a TCP Stream

This is invaluable for reading HTTP requests and responses, analyzing cleartext protocols, and understanding the flow of a connection. You can also follow UDP and TLS streams using the same right-click menu.

Understanding Color Coding

Wireshark applies color coding to packets in the packet list to help you identify traffic types at a glance. The default color rules include:

You can customize color rules through View > Coloring Rules. Custom rules let you highlight traffic that matters most to your analysis.

Common Use Cases

Wireshark is a versatile tool with applications across networking, security, and development. Here are some common scenarios where it provides critical visibility.

Network Troubleshooting

• Slow connections -- Look for TCP retransmissions (tcp.analysis.retransmission) which indicate packet loss.
• DNS failures -- Filter with dns to see if queries are failing or returning unexpected results.
• Connection refused -- Look for TCP RST (reset) packets using tcp.flags.reset == 1 to identify rejected connections.
• Duplicate IPs -- Filter for ARP traffic to detect IP address conflicts on your LAN.

Security Analysis

• Unusual outbound connections -- Filter for traffic leaving your network to unexpected IP addresses or on unusual ports.
• Cleartext credentials -- Protocols like FTP, Telnet, and HTTP Basic Auth send credentials in plain text. Following the TCP stream reveals them instantly.
• DNS tunneling -- Look for abnormally long DNS queries or high volumes of DNS traffic to a single server, which may indicate data exfiltration.
• Port scanning -- Many SYN packets to sequential ports from a single source IP indicates a port scan in progress.

Application Debugging

• API troubleshooting -- Capture HTTP traffic to see exact request headers, body content, and response codes.
• TLS handshake failures -- Filter with tls.handshake to diagnose certificate or cipher negotiation problems.
• Performance profiling -- Use Statistics > IO Graphs to visualize throughput over time and identify bottlenecks.

Summary

In this tutorial, you learned the fundamentals of Wireshark network analysis:

• What Wireshark does -- captures and dissects network traffic at the packet level
• Installation -- available on Linux, Windows, and macOS with proper user group configuration
• Capturing -- selecting interfaces, starting/stopping captures, and saving results
• Display filters -- filtering by IP, port, protocol, and combining conditions with logical operators
• TCP stream following -- reconstructing full conversations between hosts
• Practical use cases -- troubleshooting, security monitoring, and application debugging