Wireshark Tutorial: Analyze Network Traffic Like a Pro

Wireshark is the world's most popular network protocol analyzer, and learning to read packets is a superpower for security analysts, network engineers, and ethical hackers alike. It lets you see exactly what is crossing the wire: every request, response, handshake, and error. This tutorial takes you from your first capture to confident filtering and stream analysis, with real display filters you can copy and use. Only capture traffic on networks you own or are authorized to monitor.

Key Takeaways

• Wireshark captures and decodes packets so you can see the real contents of network conversations.
• Display filters are the core skill; they let you cut millions of packets down to the few that matter.
• Capture filters and display filters are different: one limits what you record, the other what you view.
• "Follow TCP Stream" reassembles a full conversation into readable form.
• Wireshark is for analysis and troubleshooting, not attacking; use it only where authorized.

Getting Started with a Capture

After installing Wireshark, launch it and you will see a list of network interfaces with live traffic sparklines. Double-click the interface carrying your traffic (often your Wi-Fi or Ethernet adapter) to begin capturing. Packets stream in immediately. Click the red stop button to end the capture, and save it as a .pcap or .pcapng file for later analysis.

Understanding the Interface

Wireshark's window has three key panes. The packet list at the top shows one line per packet with source, destination, protocol, and summary. The packet details pane in the middle expands the selected packet layer by layer, from Ethernet up through IP, TCP, and the application protocol. The packet bytes pane at the bottom shows the raw hexadecimal and ASCII. Learning to move between these three views is the foundation of packet analysis.

Capture Filters vs Display Filters

This trips up every beginner, so it is worth being clear. A capture filter is applied before recording and permanently limits what Wireshark saves (it uses BPF syntax, like host 10.0.0.5). A display filter is applied after capture and simply hides packets from view without deleting them, so you can refine it endlessly. Most of your work happens with display filters.

Essential Display Filters

Display filters go in the green bar at the top of the window. Here are the ones every analyst should know. Filter by protocol:

http
dns
tcp
udp
tls

Filter by IP address, source, or destination:

ip.addr == 192.168.1.10
ip.src == 192.168.1.10
ip.dst == 8.8.8.8

Filter by port:

tcp.port == 443
udp.port == 53

Combine conditions with and, or, and not:

ip.addr == 192.168.1.10 and tcp.port == 80
http and not ip.addr == 192.168.1.1

Filtering Application-Layer Detail

Where Wireshark really shines is drilling into protocol fields. To see only HTTP POST requests, useful for spotting form submissions and logins:

http.request.method == "POST"

Other high-value HTTP and DNS filters:

http.response.code == 404
http.host contains "example.com"
dns.qry.name contains "google"

To hunt for TCP problems such as retransmissions and resets that indicate packet loss or connection issues:

tcp.analysis.retransmission
tcp.flags.reset == 1
tcp.analysis.flags

Following a Conversation

Individual packets are hard to read in isolation. Right-click any TCP packet and choose Follow > TCP Stream to reassemble the entire conversation into a single readable window, with client data and server data color-coded. This is the fastest way to see a full HTTP exchange, an unencrypted login, or an application-level error. You can do the same for HTTP and TLS streams.

Reading TCP Handshakes and Colors

Wireshark color-codes packets by default: light purple for TCP, light blue for UDP, black for packets with errors. Watching a TCP three-way handshake (SYN, SYN-ACK, ACK) at the start of a connection helps you confirm that two hosts successfully connected. If you see many SYN packets with no replies, something is blocking the connection, a firewall, a down service, or a filtered port.

Useful Analysis Tools

Beyond filters, explore the Statistics menu. Protocol Hierarchy shows the breakdown of traffic by protocol, Conversations lists every pair of hosts talking, and Endpoints summarizes each host's activity. These give you a quick high-level picture before you dive into individual packets, which is invaluable when a capture contains hundreds of thousands of frames.

A Practical Analysis Workflow

A reliable approach to any capture is: start broad with Statistics to understand the traffic mix, narrow with a display filter to the protocol or host of interest, then follow a stream to read the full conversation. For example, to investigate a suspicious web request you might filter to http.request.method == "POST", find the packet of interest, and follow its TCP stream to see exactly what was sent.

Packet analysis is a skill that rewards practice, and the best way to build it is by capturing and dissecting real traffic in a safe lab. The Ethical Hacking and SOC tracks at TechBiz Security Academy include guided Wireshark exercises so you can practice these filters on realistic captures and learn to read the wire with confidence.

Frequently Asked Questions

Is using Wireshark legal?

Wireshark is a legitimate analysis tool, but capturing traffic on networks you do not own or are not authorized to monitor can violate privacy and wiretapping laws. Only capture on your own network or where you have explicit permission.

What is the difference between a capture filter and a display filter?

A capture filter limits which packets Wireshark records in the first place and cannot be changed afterward. A display filter only hides packets from view after capture, so you can adjust it freely without losing any data.

Can Wireshark read encrypted HTTPS traffic?

Not by default. TLS-encrypted traffic appears as ciphertext. You can only decrypt it if you have the session keys, for example by configuring a key log file for traffic you generate yourself in a lab.

How do I see a full HTTP request and response together?

Right-click a packet in the conversation and choose Follow > TCP Stream (or HTTP Stream). Wireshark reassembles the entire exchange into one readable, color-coded window showing both directions.