Practice Lab Tools
Contact Us
Not sure which tool or platform to start with? Send us your background and goals and a specialist will personally reply within one business day.
What Is Wireshark?
Wireshark is a free, open source packet analyser used to capture and inspect network traffic in real time, down to the individual byte. First released in 1998 under the name Ethereal, it has become the de facto standard tool for understanding exactly what is happening on a network, used by network engineers, security analysts, and penetration testers for entirely different reasons but with the same underlying skill.
Where a tool like Nmap tells you which ports and services exist on a target, Wireshark shows you the actual conversation happening between two devices: every request, every response, every protocol handshake, captured as it crosses the wire. This makes it the tool of choice when something needs to be understood rather than just detected, whether that is a suspicious connection, a misbehaving application, or a protocol you have never worked with before.
Wireshark supports deep inspection of several thousand network protocols, from common ones like HTTP and DNS to specialised industrial and telecom protocols most engineers will never encounter. It runs natively on Windows, macOS, and Linux, and its command-line counterpart, tshark, allows the same captures to be scripted and automated.
Capturing and Filtering Traffic With Wireshark
A capture session starts by selecting a network interface, wired or wireless, and clicking start. Within seconds, even an idle machine generates a surprising amount of traffic, which is why filtering is the skill that actually makes Wireshark usable rather than overwhelming.
Display filters narrow the view to exactly what you care about. A filter for http shows only HTTP traffic, a filter for dns isolates DNS lookups, and a port filter narrows the view to a specific service. Filters can be combined, for example an IP address together with a port number, to see only traffic between one host and one specific service.
Right-clicking any packet and choosing to follow the TCP stream reconstructs an entire conversation between two hosts as readable text, which is exactly how analysts spot credentials sent in plaintext over unencrypted protocols like old FTP or HTTP logins, long before anyone attempts to exploit them.
- Captures and inspects live network traffic in real time
- Deep dissection across several thousand supported protocols
- Powerful, combinable display filter language
- Follow entire TCP, UDP, or HTTP conversation streams
- Free and open source on Windows, macOS, and Linux
- Command-line companion tool, tshark, for scripted captures
- Built-in statistics for endpoint, protocol, and conversation analysis
- Works directly alongside Kali Linux and Nmap in a practice lab
Why Wireshark Matters for Security Work
Wireshark is used offensively to understand exactly what a target’s traffic looks like, spot exposed credentials, and confirm whether an exploit actually worked at the network level. Defensively, it is used to investigate incidents after the fact, confirm what data left a network during a breach, and validate that a firewall rule or intrusion detection signature is behaving as expected.
It is tested directly in certifications including Security+, PNPT, and OSCP, and unlike knowledge of any single exploit or vulnerability, the underlying skill of reading protocol behaviour from raw packets does not go out of date. New tools rise and fall in popularity, but every one of them eventually has to talk to a network, and Wireshark is how you verify what it is actually saying.
Step-by-Step: Your First Wireshark Capture
This short walkthrough is the standard first exercise for anyone new to packet analysis.
- Open Wireshark and select your active network interface from the start screen.
- Click the capture icon to start capturing traffic.
- Open a browser and visit any plain HTTP test page to generate visible traffic.
- Type a filter for http into the filter bar and press enter to isolate web traffic.
- Right-click a request packet and follow the HTTP stream to read the full exchange.
Repeating this exercise against different protocols, DNS, FTP, and eventually encrypted traffic, builds the pattern recognition that makes packet analysis fast rather than tedious.
Wireshark is used to capture and analyse live network traffic, helping security professionals understand protocol behaviour, spot anomalies, and investigate incidents at the packet level.
The interface takes some getting used to, but the basics of capturing traffic and applying simple filters can be learned in a single sitting. Deeper protocol analysis is a skill built over time.
Wireshark can capture encrypted packets, but it cannot read their contents without the decryption keys. You will see that traffic is happening, just not what is inside it, unless you have the relevant keys available.
Yes, Wireshark is free and open source software, available for Windows, macOS, and Linux with no licensing cost.
Nmap discovers what devices and services exist on a network. Wireshark captures and inspects the actual traffic being sent between those devices, at the packet level.
tcpdump is a lightweight, command-line-only packet capture tool, often used on servers without a graphical interface. Wireshark provides the same underlying capture engine with a full graphical interface for filtering and visual protocol analysis.
Yes, capturing live traffic generally requires elevated privileges, since it involves putting a network interface into promiscuous mode. On Linux this is typically handled through user group permissions rather than running the entire application as root.
Wireshark itself is passive and does not send traffic, so it cannot typically be detected simply by capturing packets. Some switches and monitoring systems can, however, detect when a network interface is placed in promiscuous mode.
Wireshark saves captures in the pcap or pcapng format by default, both of which are widely supported and can be reopened later, shared with colleagues, or analysed by other tools that support the same standard.