PlayInfoBox

Home /Network /What Is Packet Capture? The Basics of Analyzing Network Traffic with Wireshark

What Is Packet Capture? The Basics of Analyzing Network Traffic with Wireshark

Follow these steps in order to get from zero to reading your first captured packets.

  1. What packet capture actually is

    Packet capture means intercepting and recording the data moving across a network interface, packet by packet, so you can inspect it directly. It is a technique used to diagnose network problems or to see exactly how a protocol behaves in practice, rather than just reading about it.

  2. Install Wireshark

    Wireshark is the most widely used free, open-source packet capture and analysis tool, with installers available for Windows, Mac, and Linux from its official site. The capture driver installed alongside it is what actually does the work of intercepting packets at the system level.

  3. Choose a network interface and start capturing

    After launching Wireshark, double-click the interface (Wi-Fi, Ethernet, etc.) that is actually carrying your traffic from the list shown, and packets will start piling up on screen in real time.

  4. Narrow things down first with a capture filter

    Setting a capture filter before you start -- by a specific address or port, for example -- keeps only the traffic you care about, which reduces file size and makes analysis far less overwhelming later.

  5. Use a display filter to isolate packets after the fact

    Within an already-captured session, typing a protocol name or expression into the filter bar at the top of the window narrows the view down to only the packets matching that protocol or condition.

  6. Learn to read common traffic patterns

    Learning to recognize the TCP three-way handshake at the start of a connection, DNS queries and responses, and HTTP requests and responses lets you actually see for yourself when a connection is failing or where a delay is happening. Encrypted traffic like HTTPS still shows you metadata, like which server was contacted, but not the actual content.

A handful of display filters worth memorizing

A few expressions cover most day-to-day use: ip.addr==192.168.1.10 isolates all traffic to or from one device, tcp.port==443 narrows things to HTTPS traffic, http shows only HTTP requests and responses, and dns shows only DNS lookups. Combining filters with "&&" (and) or "||" (or) lets you narrow things down even further.

Wireshark is not the only option

Wireshark's graphical interface is the easiest way to explore captured traffic, but tcpdump, a command-line packet capture tool built into most Linux and Mac systems, is often faster for a quick check on a remote server where a GUI is not available -- you can also save a tcpdump capture to a file and open it later in Wireshark for deeper analysis.

Frequently Asked Questions

Can I only see my own computer traffic, or my neighbor too?

On a typical switched wired network, you will generally only see traffic to and from your own device by default. Depending on the network structure -- like being on the same Wi-Fi router as others -- a wider range of traffic can sometimes be visible, which is exactly why you should only ever capture on a network you are authorized to monitor.

Is using Wireshark illegal?

The tool itself is a legitimate network diagnostic program. What matters is how it is used: running it for diagnostics on a network and device you own or have explicit permission for is fine, but intercepting someone else's traffic without consent can be illegal.