If Nmap tells you "which ports are open," Wireshark shows you "exactly what's happening on the network right now" — every packet, every byte, live or from a saved capture file. It's rightfully called the "microscope for network traffic."
Important: every command in this tutorial should only be run against systems and networks you have explicit authorization to test — like your own personal lab or a formal penetration-testing engagement. Using these tools against any network or system without permission is a crime.
An additional ethical note: traffic capture should only be done on a network you own or have explicit permission to monitor — sniffing other people's traffic without permission, even on a public Wi-Fi network, is both legally and ethically problematic.
Step 1: Install and pick an interface
Download and install Wireshark from wireshark.org. After opening it, you'll see a list of network interfaces (wired NIC, Wi-Fi, etc.), each showing a live graph of passing traffic — the interface with the most activity is usually the one you should pick.
Step 2: Start your first capture
Double-click the target interface to start capturing. You should immediately see packets being added live to the list — each row is one packet, with columns for time, source, destination, protocol, and a summary.
Step 3: Getting familiar with the three main panels
Packet List (top): the overall list of all captured packets.
Packet Details (middle): when you click a packet, this panel breaks it down layer by layer — Ethernet, IP, TCP, and the upper-layer protocol (like HTTP).
Hex Dump (bottom): the packet's raw content, shown as hexadecimal bytes alongside readable text.
Step 4: Using filters to find what you're looking for
Without filters, thousands of packets pile up within seconds — filters make this manageable:
ip.addr == 192.168.1.10 — only packets involving a specific IP address
tcp.port == 443 — only HTTPS traffic
http — only (unencrypted) HTTP requests and responses
dns — only DNS queries
Step 5: The Follow TCP Stream feature
Right-click any TCP packet and select Follow > TCP Stream. This feature reassembles the entire conversation between both sides of a connection (not just one packet) into readable form — very useful for understanding a complete HTTP exchange or any other text-based protocol.
An educational example: why is HTTP dangerous?
If, on your own lab network, you test an old login form that uses HTTP (not HTTPS) and capture its traffic with the http filter, Follow TCP Stream lets you directly see the username and password in plain text — exactly what I explained about the danger of unencrypted protocols in my Cisco SSH/Telnet tutorial, now visible with your own eyes.
Why is Wireshark a foundational skill?
Every network problem, every malware analysis, and every real penetration test eventually comes down to this exact level: precisely understanding what's actually flowing across the wire. Wireshark gives you that ability, and that's exactly why it holds a central place in my network security courses.
Blog