Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer
Network analysis & monitoringPacket analysis beginner WindowsmacOSLinux

Wireshark

Wireshark is a graphical network protocol analyser that lets you capture traffic and inspect it packet by packet with deep protocol decoding.

Official site ↗Documentation ↗Source ↗
Legal & ethical use. Only capture traffic on networks you own or are authorised to monitor; captures may contain credentials and personal data. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.

What it is used for

  • Understand how a protocol such as DNS or HTTP behaves on the wire
  • Investigate a suspicious pcap in a forensics exercise
  • Troubleshoot application or network faults

Key features

  • Live capture and pcap file analysis
  • Hundreds of protocol dissectors
  • Display filters and Follow TCP Stream
  • Statistics and I/O graphs

Installation

Download the installer from wireshark.org/download.html or install from your Linux distribution (`sudo apt install wireshark`).

Beginner usage guide

Open a capture, type a display filter such as `http` or `dns` in the filter bar, select a packet and expand the layers in the details pane from Ethernet up to the application protocol.

Example commands

Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.

Open a capture and show only DNS (display filter)
dns

Type this in the display-filter bar to list DNS queries and responses only.

Show one TCP conversation
tcp.stream eq 0

Filters packets belonging to the first TCP stream; right-click a packet and choose Follow → TCP Stream to read it.

Keep learning

📘 Understanding HTTP and HTTPS
📘 Networking Fundamentals for Cybersecurity
📘 How DNS Works and Why It Matters
📘 Packet Analysis Fundamentals with Wireshark
📘 How to Build a Personal Cybersecurity Lab
🎓 Learning path: Digital Forensics
🎓 Learning path: Networking & Linux
🚩 Practice challenge: Cleartext Credentials medium

References

Source verification

Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary tshark (TShark (Wireshark) 4.6.6.) on 2026-10-27.

Related tools

ArkimeBettercapNetworkMinerSnortSuricataZeek