Wireshark Packet Analysis: Capture and Filter Traffic

Wireshark is a free packet analyzer that lets beginners capture network traffic and inspect it one protocol layer at a time. Choose the correct network interface, start a capture, then use display filters to find relevant packets without changing the original capture.

What Wireshark Shows

When devices communicate, they exchange data in units called packets or frames. Wireshark records traffic visible to the computer’s network adapter and presents decoded details such as source and destination addresses, protocol, ports, timing, and packet contents. Ethernet and Wi-Fi traffic is commonly captured as frames at the link layer; Wireshark then decodes higher-layer protocols such as IP, TCP, DNS, and HTTP where possible.

A packet list is only the starting point. Select a row to inspect its protocol layers in the middle pane, and select a field to see its bytes highlighted in the lower pane. This helps connect a readable field, such as a TCP destination port, to the bytes that carry it. A packet capture is evidence of what the capture point observed—not a complete view of everything happening across a network.

Before You Capture

Install Wireshark from its official distribution source and follow the installation prompts. Capturing usually requires permission to access the network interface; operating systems may use a separate capture component or group permissions. Use an administrator account only when needed to configure capture access, rather than routinely running the entire application with elevated privileges.

Capture only traffic you own or are authorized to inspect. Network captures may contain usernames, session tokens, DNS queries, private messages, or other sensitive information, even when the data is not immediately obvious. Keep capture files protected, limit collection to what you need, and remove them when they are no longer required.

Before starting, identify the interface that carries the traffic you want:

• For ordinary internet access, this is often the active Wi-Fi or Ethernet interface.
• For a virtual machine, VPN, container, or loopback connection, the relevant traffic may appear on a different interface.
• Interface names and activity graphs can help identify the right one. Generate a small amount of traffic, such as opening a page you control, and see which graph changes.

On a switched network, your adapter generally sees traffic sent to or from your device, plus certain broadcast or multicast traffic—not every conversation between other devices. Promiscuous mode does not bypass this network limitation. Wi-Fi capture behavior also depends on the adapter, driver, operating system, and whether monitor mode is supported.

How to Capture Traffic

1. Open Wireshark and review the interface list. Double-click the likely interface, or select it and choose the start-capture control.
2. Reproduce the activity you want to investigate. Keep the test focused: for example, make one DNS lookup or connect once to a service. Note the time so you can find the exchange later.
3. Stop the capture when you have enough data. A short capture is easier to interpret and less likely to collect unrelated sensitive information.
4. Save useful evidence as a capture file, commonly in the PCAPNG format. Preserve an untouched copy if the capture matters for later analysis, and work on a copy when you need to remove or alter data.

Captures can grow quickly on a busy interface. If you know the traffic of interest in advance, a capture filter can reduce what is recorded. For a first exercise, however, capture briefly and then filter the saved packets using display filters. Display filters hide nonmatching packets from the view but do not delete them from the capture.

Capture Filters and Display Filters

Capture filters use the Berkeley Packet Filter (BPF) syntax and are applied before packets are recorded. For example, host 192.0.2.10 captures traffic to or from that example address, while port 53 limits capture to traffic using port 53. Capture filters can reduce file size, but a mistaken filter can permanently exclude packets you later need.

Display filters use Wireshark’s own field-based syntax and are applied after capture. They are more expressive and can be changed repeatedly without recapturing. Enter a filter in the display-filter bar; a valid expression is accepted, while invalid syntax is flagged. Useful beginner examples include:

• dns — show packets Wireshark recognizes as DNS.
• ip.addr == 192.0.2.10 — show IPv4 packets where that address is either source or destination.
• tcp.port == 443 — show TCP packets with source or destination port 443.
• tcp.stream eq 0 — focus on the TCP conversation Wireshark labels as stream 0.
• http.request — show decoded HTTP request packets, when such traffic is present and recognizable.

Operators matter: == tests equality, and && combines conditions. For example, dns && ip.addr == 192.0.2.10 narrows the view to DNS packets involving that address. Field names depend on protocol and context; use Wireshark’s filter autocomplete or select a packet field and apply it as a filter instead of guessing.

Read a Conversation, Not Just One Packet

Most network activity is a sequence. A DNS lookup may show a query followed by a response; TCP communication may begin with a three-way handshake, exchange data, and finish with connection-closing packets. Select a TCP packet and use the conversation or stream-following tools to view related packets together. Stream following is a convenient reconstruction view, not proof that the application data is readable or complete.

Encrypted protocols change what inspection reveals. With HTTPS, a capture commonly exposes addresses, ports, timing, packet sizes, and some connection metadata, but not the protected page contents. TLS decryption requires appropriate session secrets or keys and a legitimate basis to access them. Do not assume that seeing a connection means Wireshark can reveal its passwords or messages.

For a practical first analysis, capture while making one connection to a site you control, filter for DNS, identify the lookup and response, then filter for the server address and inspect the TCP or TLS exchange. Compare timestamps and endpoints, and avoid treating one missing packet as conclusive: capture loss, routing, encryption, and the chosen interface can all affect what appears.

Common Problems and Useful Habits

• No interfaces or permission errors: Check whether the capture component is installed and whether your account has the required capture permissions. Restart Wireshark after changing permissions if necessary.
• No packets appear: Confirm the interface, generate traffic during the capture, and check whether a VPN or virtual adapter carries it instead. A display filter may also be hiding packets; clear it to inspect the full capture.
• A filter shows nothing: Verify the field and value against a packet’s details. Check whether the traffic uses TCP or UDP, IPv4 or IPv6, and whether encryption or a different protocol changes what Wireshark can decode.
• Names appear instead of addresses: Name resolution can make packet lists easier to read, but it can also trigger lookups or obscure the raw address. Toggle resolution settings when precise address-level analysis matters.
• The capture is incomplete: Check for dropped packets and capture duration, and consider whether the interface can observe the traffic at all. Wireshark cannot recover packets that never reached the capture point.

Use descriptive filenames and record the interface, time, and test action. Be cautious when sharing captures: removing a few visible packets is not the same as securely sanitizing a file, and packet contents or metadata may still identify people or systems.

Frequently Asked Questions

Is Wireshark free to use?
Wireshark is free, open-source software. Download it from its official project distribution source and follow the installation guidance for your operating system.

Can Wireshark capture all traffic on my Wi-Fi network?
Usually not just by enabling promiscuous mode. Your adapter typically sees its own traffic and certain shared traffic. Observing other wireless conversations requires suitable hardware, driver support, capture mode, and authorization.

What is the difference between a capture filter and a display filter?
A capture filter decides which packets are recorded in the first place. A display filter only changes which already-recorded packets appear in the interface, so it is safer to experiment with display filters when learning.

Can Wireshark read HTTPS passwords?
Normally, no. HTTPS encrypts application data, so a basic capture does not reveal protected page contents or passwords. Decryption depends on access to suitable session secrets and other conditions.

Why does my filter return no results?
The capture may not contain matching traffic, the wrong interface may have been selected, or the expression may use an incorrect field or value. Clear the display filter, inspect a relevant packet, and build a filter from one of its decoded fields.

Related

• Best Skype Alternatives: Top Picks for Calls and Chat
• ARK With Friends: Dedicated Server vs Co-op
• Can’t Claim or Access a Grok Email Address? What to Do