Wireshark Tutorial
Wireshark captures and displays network traffic packet by packet. You start a capture on an interface, apply a display filter to cut the noise, and read the conversation. The filters you will use constantly are protocol filters like http or dns and address filters like ip.addr, combined to isolate exactly the traffic you care about.
What Wireshark is for
Wireshark shows you what is actually crossing the wire. Security uses: spotting plaintext credentials, understanding a protocol, analysing malware traffic, and confirming what an application really sends versus what it claims to.
Capturing traffic
Pick an interface and start. On a busy network you will see thousands of packets a second, which is why filters matter immediately.
Capture filters vs display filters
| Capture filter | Display filter | |
|---|---|---|
| When applied | Before capture | After capture |
| Syntax | BPF, like tcp port 80 | Wireshark, like http |
| Use | Limit what is recorded | Search what you recorded |
The display filters you actually use
http
dns
ip.addr == 10.10.10.5
tcp.port == 443
http.request.method == "POST"
tcp.flags.syn == 1Following a stream
Right click a packet and Follow, then TCP Stream, to see an entire conversation reassembled as readable text. This is how you spot credentials sent over plain HTTP or read a protocol exchange end to end.
Spotting credentials in plaintext
Filter for http POST requests and follow the stream. Any application still sending logins over plain HTTP will show the username and password in clear text. This single demonstration convinces developers to enforce HTTPS faster than any report paragraph.
Reading the TCP handshake
Filter for tcp.flags.syn == 1 and you will see connection setups. Understanding SYN, SYN-ACK, ACK here connects directly to how port scans work, covered in the Nmap tutorial.
Common mistakes
- Capturing everything and drowning instead of filtering early
- Confusing capture filters with display filters
- Forgetting you can only see traffic that reaches your interface
- Not using Follow Stream, then reading packets one by one
Practise this
Capture your own traffic while browsing, then filter it down. Watching a login you control cross the wire teaches more than any tutorial. Free labs on Hacklido.
Enroll in SOC
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in SOC