Introduction
In cybersecurity and networking, understanding what is happening inside a network is extremely important. When a website is opened, an application sends a request, or a device communicates with a server, a large amount of network traffic is exchanged in the background.
But how can we actually see and analyze this traffic?
This is where Wireshark comes in.
Wireshark is a free and open-source network protocol analyzer that allows us to capture and inspect network packets. It is widely used by network administrators, cybersecurity professionals, developers, and students to understand network communication and troubleshoot problems.
What is Wireshark?
Wireshark is a tool used to capture and analyze packets travelling through a network.
Think of network communication like sending letters between two people. Each letter contains information about where it came from, where it is going, and what it contains.
Similarly, network communication is divided into packets. Wireshark allows us to examine these packets and understand how devices communicate.
Wireshark can:
- Capture live network traffic
- Analyze previously captured traffic
- Inspect different network protocols
- Filter packets
- Troubleshoot network problems
- Investigate suspicious network activity
- Understand how protocols work
Wireshark supports live capture from network interfaces such as Ethernet and Wi-Fi and can also analyze saved capture files.
Why is Wireshark Important in Cybersecurity?
For cybersecurity professionals, network traffic can provide valuable information about what is happening on a system or network.
For example, Wireshark can help investigate:
- Suspicious connections
- Unusual IP addresses
- Unexpected network communication
- DNS requests
- TCP connections
- HTTP traffic
- Network troubleshooting
- Possible malware communication
- Protocol-related problems
However, Wireshark itself does not automatically tell you whether traffic is malicious. The analyst needs to understand the packets, protocols, IP addresses, ports, and communication patterns.
How Does Wireshark Work?
The basic process is:
Network Interface → Packet Capture → Packet Dissection → Filtering → Analysis
When Wireshark starts capturing, it listens to a selected network interface and records packets that are visible to that interface.
The captured packets are then broken down into protocol layers so that the user can inspect their individual fields.
Wireshark's interface commonly contains three important sections:
- Packet List Pane
- Packet Details Pane
- Packet Bytes Pane
The packet list provides a summary of captured packets, while selecting a packet allows its protocol details and raw bytes to be examined.
Understanding a Packet
A packet contains different pieces of information.
For example, when analyzing an IP packet, you may find information such as:
- Source IP address
- Destination IP address
- Protocol
- Packet length
- Time
- Header information
- Payload data
Wireshark breaks the packet into protocol layers, making it easier to understand the communication.
A simplified example is:
Ethernet → IP → TCP → Application Protocol
Each layer provides additional information about the communication.
Capturing Packets with Wireshark
To capture traffic:
Step 1: Open Wireshark
Launch Wireshark on your computer.
Step 2: Select a Network Interface
Wireshark will display available interfaces such as:
- Wi-Fi
- Ethernet
- Loopback
Choose the interface through which the traffic you want to analyze is travelling.
Step 3: Start Capture
Start the packet capture.
You will see packets appearing in real time.
Step 4: Generate Some Traffic
For example, open a website or perform another network activity.
Wireshark will capture the packets generated by that activity.
Step 5: Stop the Capture
Once enough traffic has been collected, stop the capture and begin analyzing the packets.
Wireshark's official documentation describes live packet capture as one of its major features.
What are Wireshark Filters?
One of the most useful features of Wireshark is filtering.
A busy network can generate thousands of packets. Looking through every packet manually would be difficult.
Filters allow us to focus only on the traffic we are interested in.
Wireshark has two important types of filters:
1. Capture Filters
Capture filters determine what traffic is captured in the first place.
They are useful when you already know what type of traffic you want to capture.
2. Display Filters
Display filters are applied after packets have been captured. They control which packets are displayed without deleting the other packets from the capture.
Useful Wireshark Display Filters
Here are some beginner-friendly examples:
Show TCP packets
tcp
This displays packets containing TCP.
Show UDP packets
udp
Show DNS traffic
dns
Show HTTP requests
http.request
Filter by IP address
ip.addr == 192.168.1.10
Show traffic from a specific IP
ip.src == 192.168.1.10
Show traffic going to a specific IP
ip.dst == 192.168.1.10
Wireshark's documentation supports filtering by protocols, fields, values, and comparisons.
TCP Analysis in Wireshark
TCP is one of the most important protocols to understand when learning Wireshark.
A TCP connection commonly begins with the three-way handshake:
Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server
This establishes a TCP connection between the two systems.
In Wireshark, you can filter TCP traffic using:
tcp
You can then inspect TCP flags such as:
- SYN
- ACK
- FIN
- RST
- PSH
Understanding these flags can help when troubleshooting connection problems and analyzing network behavior.
DNS Analysis
DNS converts domain names into IP addresses.
For example:
example.com → IP address
When a device accesses a domain, it may first send a DNS query.
In Wireshark, you can use:
dns
to focus on DNS packets.
You can then examine:
- DNS queries
- DNS responses
- Requested domains
- Response addresses
- Query types
DNS analysis can be useful during troubleshooting and security investigations.
Wireshark in a Cybersecurity Investigation
Imagine a security analyst notices that a computer is making unusual connections.
The analyst could use Wireshark to investigate:
Source IP
↓
Destination IP
↓
Protocol
↓
Port
↓
Packet Contents / Metadata
↓
Communication Pattern
By examining these details, the analyst can develop a better understanding of the network activity.
Wireshark can therefore be useful during:
- Incident investigation
- Network troubleshooting
- Malware analysis
- Security monitoring
- Protocol analysis
- Network forensics
Advantages of Wireshark
Free and Open Source
Wireshark is freely available and open source.
Detailed Packet Analysis
It provides detailed information about network packets and supports inspection of hundreds of protocols.
Powerful Filtering
Filters make it possible to focus on specific protocols, addresses, fields, and values.
Cross-Platform
Wireshark runs on multiple operating systems, including Windows, Linux, and macOS.
Useful for Learning
Students can use Wireshark to understand how networking protocols work in real-world traffic.
Limitations of Wireshark
Wireshark is powerful, but it is not a magic cybersecurity tool.
Some limitations include:
- Large captures can contain huge amounts of data.
- Beginners may find packet details confusing.
- Encrypted traffic limits visibility into application contents.
- Understanding packets requires networking knowledge.
- Capturing traffic does not automatically identify an attack.
To use Wireshark effectively, it is helpful to understand concepts such as TCP/IP, DNS, HTTP, TCP, UDP, IP addresses, ports, and network layers.
Beginner Practice Idea
If you're learning cybersecurity, try this simple experiment.
Experiment
- Open Wireshark.
- Select your active network interface.
- Start capturing.
- Open a website in your browser.
- Stop the capture.
- Apply:
dns
- Examine the DNS packets.
- Then try:
tcp
- Select a TCP packet.
- Explore the Ethernet, IP, and TCP sections.
This simple exercise can help you understand how a normal web request generates network traffic.
Conclusion
Wireshark is one of the most useful tools for learning and analyzing computer networks.
It allows us to move beyond simply knowing that devices communicate and actually examine how that communication happens.
For cybersecurity students, learning Wireshark can build a strong foundation in:
Networking → Packet Analysis → Protocols → Troubleshooting → Security Investigation
The most important thing is not just learning Wireshark commands. The real skill is learning how to interpret the information inside the packets.
Once you understand networking fundamentals, Wireshark becomes much easier—and much more powerful.
