Wireshark — Packet Analyzer GuideStep-by-step Wireshark reference: capture, display filters, follow TCP streams and spot plaintext passwords. Educational use only.FAQ

What is Wireshark?

Wireshark is the standard packet analyzer: it records the raw traffic on a network interface and shows every packet — source, destination, protocol and contents. Admins use it to debug networks; attackers use it to steal anything sent unencrypted.

Is Wireshark illegal?

The tool is legal and essential for network debugging. Capturing traffic on networks you do not own or without permission — especially to read others' data — is illegal. Capture on your own machine and lab VMs only.

How do I start my first capture?

Open Wireshark, double-click your active interface (WiFi or Ethernet), generate traffic like opening a lab login page, then press the red square to stop. Start with a capture filter like host 192.168.1.1 to keep it small.

What are display filters?

Display filters search captured packets: http shows web traffic, dns shows lookups, ip.addr == 1.2.3.4 narrows to one host, tcp.port == 80 to one service. Learn five filters and you can find anything in a million-packet capture.

How do I read a full login with Follow TCP Stream?

Right-click any packet of the connection, choose Follow then TCP Stream: Wireshark rebuilds the whole conversation — request, response, credentials — in reading order. On lab HTTP logins the password sits there in plain text.

Why can't I read HTTPS traffic?

TLS encrypts the contents, so Wireshark shows only metadata: IPs, ports, packet sizes, timing and the SNI hostname. That is exactly why every login page must use HTTPS — encryption is what stands between passwords and sniffers.

What is promiscuous mode?

Normally a network card ignores packets not addressed to it. Promiscuous mode tells it to hand everything to Wireshark. On switched networks you still mostly see your own traffic plus broadcasts — full interception needs ARP spoofing, which stays lab-only.

How do I protect my network from sniffing?

Use TLS everywhere, replace Telnet and FTP with SSH and SFTP, run WPA3 on WiFi, and move DNS to encrypted DNS. Then verify with Wireshark itself: capture your own login and confirm nothing readable leaks.

All tools · Sitemap · Games