Wireshark is one of the most widely used tools for examining network traffic. It helps network administrators, cybersecurity professionals, and digital forensic investigators understand how devices communicate and identify unusual activity.
A slow connection, a failed website request, or an unexpected connection to a remote server can leave clues in captured network packets. Wireshark allows these packets to be examined in detail, making it useful for troubleshooting and security investigations
What exactly is wireshark ?
Wireshark is a free, open-source network protocol analyzer. It captures network packets and presents their contents in a structured, readable format.
A packet is a unit of data transmitted across a network. It contains protocol information and may also contain a portion of the transmitted data.
Wireshark can help identify source and destination addresses, communication protocols, timestamps, ports, and packet contents when those contents are available. It supports protocols such as Domain Name System (DNS), Transmission Control Protocol (TCP), and Internet Control Message Protocol (ICMP).
It is important to understand that Wireshark does not automatically identify a criminal or prove that an attack has occurred. It provides network evidence that must be interpreted in context.
How To Download And Install Wireshark
Download Wireshark from its official website. Select the installer for the operating system in use and follow the installation instructions. On Windows, packet capture commonly uses Npcap, which allows Wireshark to capture traffic from supported network interfaces.
Open Wireshark after installation. The welcome screen displays available network interfaces, such as Wi-Fi and Ethernet. Select the interface carrying the traffic you want to examine.
Only capture traffic on networks and devices you own or are explicitly authorized to monitor. Captures can contain sensitive information.
How To capture Network Packets
1. Open the Wireshark and identify the active network interface
2. Double-click the interface to start capturing packets.
3. Generate ordinary network activity, such as opening a website you are authorized to access.
4. Allow a short capture period, then click the red stop button.
5. Examine the packet list and save the capture for later analysis.
Wireshark displays packets as they are captured. The volume of traffic depends on the selected interface, the network environment, and the activity taking place. On switched Ethernet and modern Wi-Fi networks, the capture may not include every packet exchanged by other devices.
Understanding The Wireshark Interface
The main window has three important areas:
Packet List: Displays captured packets with fields such as time, source, destination, protocol, length, and summary.
Packet Details: Expands the selected packet into protocol layers and their fields.
Packet Bytes: Shows the packet data in hexadecimal and, where applicable, a corresponding text representation.
Selecting a packet in the list updates the details and bytes panes. Expanding protocol layers reveals information such as Internet Protocol (IP) addresses, TCP ports, DNS queries, and protocol-specific fields.
These areas work together to show both the overall communication pattern and the technical details of an individual packet
How To Use Wireshark Filters
A busy capture may contain thousands of packets. Filters narrow the displayed results so that relevant traffic is easier to examine.
Enter a filter in the display filter bar and press Enter.
| Display filters | Purpose |
|---|---|
| dns | Shows Domain Name System packets |
| tcp | Shows Transmission Control Protocol Packets |
| icmp | Shows Internet Control Message Protocol Packets |
| ip.addr == 192.168.1.10 | Shows IPv4 Packets Involving This Address |
| tcp.port == 443 | Shows tcp packets with source or destination port 443 |
Replace the example IP address with one relevant to the capture. Port 443 is commonly used for HTTPS, but the port number alone does not establish which application or service is involved.
One important distinction: Display filters hide packets that do not match the expression, but they do not remove those packets from the original capture. Capture filters, by contrast, restrict which packets are collected in the first place. Their syntax differs.
How To Investigate Network Activity
Wireshark becomes more useful when packet information is examined alongside the event being investigated. For example, if a device cannot reach a website, DNS queries and responses may help establish whether name resolution succeeded. TCP packets can help reveal connection attempts, acknowledgements, retransmissions, or resets.
For a basic investigation:
- Identify the device and approximate time of the problem.
- Apply a relevant display filter.
- Inspect source and destination addresses, ports, timestamps, and protocol details.
- Look for patterns that match the reported problem.
- Compare findings with other available evidence, such as firewall logs or endpoint records.
A suspicious packet is not automatically proof of malicious activity. Unexpected connections may have legitimate explanations, and a reliable conclusion requires supporting evidence.
Saving And Reviewing Captures
Save a capture using File → Save As. Wireshark's default capture format is Packet Capture Next Generation (.pcapng), which supports additional capture metadata. Other supported formats include the traditional pcap format.
For an investigation, preserve the original capture, record the collection time and interface, and document the filters and observations used during analysis. If evidential integrity matters, calculate a cryptographic hash of the saved file and document the result.
What Wireshark Cannot Show
Wireshark has important limitations. HTTPS traffic is generally encrypted using Transport Layer Security (TLS), so a capture alone usually cannot reveal the underlying webpage content. Some connection metadata may remain visible, depending on the protocols and configuration.
Similarly, capturing traffic from one device does not guarantee visibility into every device on the network. Missing packets, limited capture permissions, encryption, and incorrect interface selection can all affect the findings.
Wireshark is most effective when its results are interpreted alongside other technical evidence rather than treated as a complete account of network activity.
Conclusion
Learning how to use Wireshark starts with capturing packets, understanding protocol fields, and applying the correct filters. These skills provide a foundation for network troubleshooting, cybersecurity monitoring, and digital forensic investigations. Accurate analysis depends on careful interpretation, documented findings, and supporting evidence.
ForensicSpot tip: Practise with your own network traffic or authorized sample packet captures before analysing real incident evidence.