You need a terminal. The capture tool used here is tcpdump,
which is on nearly every Linux and macOS already (tcpdump --version); it needs
sudo because reading raw packets is privileged. To see the captures with a
graphical face, install Wireshark (sudo apt install wireshark,
or wireshark.org) — it opens the exact same
.pcap file tcpdump writes.
🔴 Capture only your own traffic. Everything here captures on the loopback
interface (lo) — traffic your own machine sends to itself — so there
is no one else’s data involved. Capturing other people’s traffic on a shared
network is a serious matter; keep to lo and hosts you own.
The captured output below was produced with tcpdump; the Wireshark GUI steps
describe the same actions in its window.
What Is Wireshark
Wireshark is the world's most widely used network protocol analyzer. It lets you capture live network traffic and inspect it at a granular level -- down to individual packets and the bytes within them. Network administrators use it to troubleshoot connectivity issues, security professionals use it to investigate suspicious activity, and developers use it to debug application protocols.
Wireshark is open-source, cross-platform, and completely free. It supports hundreds of protocols and can read capture files from many other tools, making it the de facto standard for network analysis.
Only capture and analyze traffic on networks you own or have explicit written authorization to monitor. Intercepting network traffic without permission is illegal in most jurisdictions. In corporate environments, always obtain approval from your IT department or management before running Wireshark. This tutorial is strictly for authorized, educational, and defensive purposes.
Installing Wireshark
Wireshark is available in the default repositories of most Linux distributions and can be downloaded directly for Windows and macOS.
Ubuntu / Debian
# Install Wireshark
sudo apt update
sudo apt install wireshark
# During installation, select "Yes" when asked whether
# non-superusers should be able to capture packets
After installation, add your user to the wireshark group so you can capture
packets without running as root:
# Add your user to the wireshark group
sudo usermod -aG wireshark $USER
# Log out and log back in for the group change to take effectRunning Wireshark as root is a security risk. The capture engine (dumpcap) processes raw network data, and a malformed packet could theoretically exploit a vulnerability. By running only dumpcap with elevated privileges and the GUI as a normal user, you limit the attack surface.
Fedora / RHEL
sudo dnf install wireshark wireshark-qt
sudo usermod -aG wireshark $USERWindows
https://www.wireshark.org/download.html
Verify the installation by opening Wireshark. You should see a list of available network interfaces on the welcome screen.
Capturing Packets
Capturing is the core function of Wireshark. You select a network interface, start the capture, and Wireshark records every packet that passes through that interface.
Selecting an Interface
When you open Wireshark, the welcome screen displays all available network interfaces along with a small sparkline graph showing current activity on each one. Choose the interface that carries the traffic you want to analyze:
Starting and Stopping a Capture
You can also capture from the command line using tshark, the terminal-based
companion to Wireshark:
# Capture 100 packets on eth0 and save to file
tshark -i eth0 -c 100 -w capture.pcapng
# Capture with a display filter (HTTP traffic only)
tshark -i eth0 -Y "http" -c 50Saving Captures
Save your capture for later analysis using File > Save As. Wireshark
defaults to the .pcapng format, which supports annotations and multiple
interfaces. You can also export as the older .pcap format for compatibility
with other tools.
Display Filters
A busy network can produce thousands of packets per second. Display filters let you narrow down the packet list to only the traffic you care about. The filter bar is located at the top of the main window -- type a filter expression and press Enter.
Display filters hide packets from view but keep them in the capture file. Capture filters (set before starting a capture) prevent packets from being recorded at all. For beginners, display filters are safer because you can always remove the filter and see everything again.
Essential Display Filters
Combining Filters
You can combine multiple conditions using logical operators:
# Traffic from a specific IP on port 80
ip.addr == 192.168.1.100 && tcp.port == 80
# DNS or HTTP traffic
dns || http
# All traffic except ARP broadcasts
!arp
# TCP traffic from a subnet
ip.src == 10.0.0.0/24 && tcpThe filter bar turns green when the syntax is valid and red when there is an error. Wireshark also provides autocomplete suggestions as you type.
Following TCP Streams and Color Coding
One of Wireshark's most powerful features is the ability to reconstruct and view an entire TCP conversation between two hosts.
Following a TCP Stream
This is invaluable for reading HTTP requests and responses, analyzing cleartext protocols, and understanding the flow of a connection. You can also follow UDP and TLS streams using the same right-click menu.
Understanding Color Coding
Wireshark applies color coding to packets in the packet list to help you identify traffic types at a glance. The default color rules include:
You can customize color rules through View > Coloring Rules. Custom rules let you highlight traffic that matters most to your analysis.
Common Use Cases
Wireshark is a versatile tool with applications across networking, security, and development. Here are some common scenarios where it provides critical visibility.
Network Troubleshooting
- Slow connections -- Look for TCP retransmissions (
tcp.analysis.retransmission) which indicate packet loss. - DNS failures -- Filter with
dnsto see if queries are failing or returning unexpected results. - Connection refused -- Look for TCP RST (reset) packets using
tcp.flags.reset == 1to identify rejected connections. - Duplicate IPs -- Filter for ARP traffic to detect IP address conflicts on your LAN.
Security Analysis
- Unusual outbound connections -- Filter for traffic leaving your network to unexpected IP addresses or on unusual ports.
- Cleartext credentials -- Protocols like FTP, Telnet, and HTTP Basic Auth send credentials in plain text. Following the TCP stream reveals them instantly.
- DNS tunneling -- Look for abnormally long DNS queries or high volumes of DNS traffic to a single server, which may indicate data exfiltration.
- Port scanning -- Many SYN packets to sequential ports from a single source IP indicates a port scan in progress.
Application Debugging
- API troubleshooting -- Capture HTTP traffic to see exact request headers, body content, and response codes.
- TLS handshake failures -- Filter with
tls.handshaketo diagnose certificate or cipher negotiation problems. - Performance profiling -- Use Statistics > IO Graphs to visualize throughput over time and identify bottlenecks.
Wireshark's Statistics menu provides powerful summaries: Conversations shows top talkers on your network, Protocol Hierarchy breaks down traffic by protocol, and Endpoints lists every host that appeared in the capture.
Now Do It Yourself: Capture and Read Real Packets in Five Steps
Wireshark feels like magic until you realise it is just reading a file of captured packets. You
will make that file with tcpdump, watch a TCP connection being born inside it, pull the
actual request text out of the bytes, then open the very same file in Wireshark and filter it —
so the GUI stops being mysterious. Every tcpdump block below was produced by running it.
Go: open two terminals. In the first, start a throwaway web server so you
have your own traffic to capture: python3 -m http.server 8000.
Do: in the second terminal, capture up to twelve packets on loopback to a file, then immediately make one request so there is something to catch.
sudo tcpdump -i lo -n -w capture.pcap -c 12 tcp port 8000 &
curl -s localhost:8000 > /dev/nullYou should see: tcpdump report that it captured the packets
and exit:
12 packets capturedYou now have capture.pcap — a real recording of a network conversation,
the same format Wireshark reads.
If not: Operation not permitted means you left off
sudo. If it says 0 packets captured, no traffic hit port 8000 before
the capture ended — start the capture first, then run the curl. If port
8000 is busy, use 8001 in both commands.
Go: the same terminal.
Do: replay the capture from the file — no live traffic needed now.
tcpdump -r capture.pcap -nYou should see: every connection opens with the same three-packet dance
— [S] (SYN), [S.] (SYN-ACK), [.] (ACK). The
numbers differ each run; the flag sequence does not:
IP 127.0.0.1.37632 > 127.0.0.1.8000: Flags [S], ...
IP 127.0.0.1.8000 > 127.0.0.1.37632: Flags [S.], ...
IP 127.0.0.1.37632 > 127.0.0.1.8000: Flags [.], ...
IP 127.0.0.1.37632 > 127.0.0.1.8000: Flags [P.], ... length 33The [P.] packet with length 33 is the one carrying your request.
Everything Wireshark shows is this, laid out in a table.
If not: if tcpdump: Couldn't change to 'tcpdump' appears (it
can on some sandboxed setups), add -Z root: tcpdump -r capture.pcap -n -Z
root. On your normal desktop you will not need it.
Go: the same terminal.
Do: add -A to print the packet payloads as ASCII text.
tcpdump -r capture.pcap -A -n | grep -aE 'GET|Host'You should see: the literal HTTP request that was inside those packets:
GET / HTTP/1.0
Host: labThis is the whole reason capturing matters, and the whole reason to fear plain HTTP: the
request travelled in clear text, so anyone who captured it read it word for word. Over HTTPS
the same -A would show only encrypted noise — which is the point of HTTPS.
If not: if grep finds nothing, your request used a different
path or the server sent no readable text; drop the grep and read the raw
-A output to see what is there.
Go: launch Wireshark and choose File → Open, then pick
capture.pcap — the exact file you just made.
Do: type http into the display filter bar at the top
and press Enter. Then right-click any remaining row and choose Follow → TCP
Stream.
You should see: the packet list shrink to just the HTTP packets, and the
Follow-Stream window show the request and response as one readable conversation — the
graphical version of your -A output in step 3, colour-coded by protocol.
If not: if the filter bar turns red, you mistyped the filter — it is
lowercase http, not HTTP. If no rows remain, the capture had no HTTP
(only the handshake was caught); re-capture with a larger -c so the data packets
are included.
Go: back to the terminal, and note the difference against what you did in Wireshark.
Do: compare the two filters you have now used. The capture filter decides what is recorded; the display filter decides what is shown from an existing recording.
tcpdump -i lo -n tcp port 8000 # CAPTURE filter (BPF): only these packets are saved
# in Wireshark's top bar: http # DISPLAY filter: hide everything but HTTP, but all is still savedYou should see: the consequence of the difference — a capture filter
that is too narrow throws data away permanently, while a display filter only hides,
so you can always widen it again. Their syntax even differs: tcp port 8000 to
capture, tcp.port == 8000 to display.
If not: if a packet you expected is simply missing and no display filter brings it back, your capture filter excluded it — capture broadly, filter the display narrowly, is the habit that saves you re-running a capture you cannot repeat.
Without scrolling up: you captured a login over plain HTTP and, with -A, could
read the password in the packets. Your colleague says “but I had a display filter set to
hide it.” Were they protected? Answer: no. A display filter only changes what
Wireshark shows; the password is still in the .pcap in clear
text and anyone can reveal it by clearing the filter. The only real protection is that the
traffic be encrypted (HTTPS) so it was never readable in the capture at all — and the
only way to keep it out of the file entirely is a capture filter, which
chooses what is recorded.
Now do it without the page: capture again, but this time
curl -s https://localhost is not available, so capture a real HTTPS site you own
or curl https://example.com on port 443 (sudo tcpdump -i any -w tls.pcap -c
20 tcp port 443). Run -A on it and confirm you can read nothing
— that unreadable payload is encryption doing its job.
Summary
In this tutorial, you learned the fundamentals of Wireshark network analysis:
- What Wireshark does -- captures and dissects network traffic at the packet level
- Installation -- available on Linux, Windows, and macOS with proper user group configuration
- Capturing -- selecting interfaces, starting/stopping captures, and saving results
- Display filters -- filtering by IP, port, protocol, and combining conditions with logical operators
- TCP stream following -- reconstructing full conversations between hosts
- Practical use cases -- troubleshooting, security monitoring, and application debugging
Never use Wireshark to capture traffic on networks you do not own or have explicit permission to monitor. Unauthorized packet capture is a criminal offense in many countries. Use this knowledge responsibly and ethically.
You now have the foundational skills to capture and analyze network traffic with Wireshark. Practice on your own home network to build familiarity with the interface and common traffic patterns.