Capture Network Traffic with Wireshark

You're staring at a wall of cryptic network traffic every time you run a scan or exploit, and you have no idea what's actually being sent or received. That's the blind spot that makes every ethical hack feel like guesswork. Wireshark is the x-ray vision you've been missing — it shows you every packet crossing the wire, letting you verify attacks, spot misconfigurations, and prove impact in ways that tools alone never will.

In this lesson, you'll learn to use Wireshark to capture network traffic with confidence: understand the mental model, drive the interface, capture live packets, filter them like a pro, and troubleshoot the most common pitfalls. By the end, you'll have a repeatable workflow for inspecting any traffic on your network — a skill that carries straight into the next lessons on protocol analysis and exploitation.

The problem this lesson solves

Every ethical hacker has been there: you run a tool like Nmap or Metasploit, it tells you something happened, but you can't see what the target actually received. You're working blind. Without packet-level visibility, you can't confirm that your exploit delivered its payload, that your scan didn't trigger a crash, or that your data exfiltration test actually moved the bytes you expected.

Wireshark solves the "black box" problem by capturing the raw packets that flow across your network interface. It answers questions like:

• What protocols are in use on this network?
• Is that server really responding to my SYN packets?
• Did my payload actually arrive at the target?
• Are there suspicious connections I should investigate?

For an ethical hacker, Wireshark is both a reconnaissance tool and a verification tool. In recon, you use passive captures to map the network without sending a single packet. During an engagement, you use it to confirm that your active traffic behaves exactly as intended. Without it, you're flying blind.

Core concept / mental model

Think of Wireshark as a wiretap for your network interface. It puts your NIC into promiscuous mode — meaning it tells the network card to capture every packet it sees, not just those addressed to your machine. The captured packets are then decoded into a human-readable format, organized in a three-pane layout that lets you drill from summary down to raw hex.

The key mental model is the packet lifecycle:

1. Capture: Wireshark copies packets from the interface into memory.
2. Decode: It parses each packet according to its protocol (Ethernet, IP, TCP, HTTP, etc.).
3. Display: It presents the decoded data in a table, with expandable protocol trees and a hex dump.
4. Filter: You narrow the view to specific packets using display filters (which only affect what you see, not what's captured).

This distinction is crucial: capture filters (applied before capture) limit what gets stored, while display filters (applied after) only hide packets from your view. Mixing them up is a classic beginner mistake.

Wireshark works in three modes: live capture (real-time), offline analysis (opening a saved capture file), and remote capture (capturing from another machine via SSH or similar). For most ethical hacking work, you'll start with live captures on your own interface.

How it works step by step

Here's the canonical workflow to use Wireshark to capture network traffic:

1. Choose the right interface. Launch Wireshark and select the network interface that carries the traffic you care about. On a typical lab machine, that's eth0 (wired) or wlan0 (wireless). The interface list shows a tiny live graph of traffic — pick the one with activity.

2. Apply a capture filter (optional). If you only want certain packets (e.g., HTTP), apply a capture filter before starting. Capture filters use a BPF syntax (from tcpdump). Example: tcp port 80.

3. Start the capture. Click the shark fin icon or double-click the interface. Wireshark immediately begins capturing packets.

4. Generate traffic. To see something meaningful, generate traffic to or from your machine (e.g., visit a website, ping a host, or run a scan).

5. Stop the capture. Click the red stop button when you have enough data.

6. Analyze with display filters. Use the filter bar to drill into specific protocols, IPs, or ports, and follow TCP streams to read full conversations.

Pro tip: Before starting a capture, think about what you want to see. If you're testing a web app, you only need port 80/443. Use a capture filter to keep the capture small and fast — this avoids disk fills and makes analysis a breeze.

Hands-on walkthrough

Let's put this into practice. We'll capture DNS traffic to your local resolver — a safe, foundational exercise.

Step 1: Open Wireshark and pick your interface

Launch Wireshark from your terminal or application menu. On the welcome screen, you'll see a list of interfaces. Choose the one that's active (usually the one with the waving line).

Step 2: Apply a capture filter for DNS

Before you start, enter a capture filter in the Capture Options dialog (or use the filter bar at the top). For DNS, that's:

udp port 53

This tells Wireshark to only store UDP traffic on port 53 (DNS).

Step 3: Start capturing and generate traffic

Click the blue shark fin to begin. Now, in a terminal (or your browser), run:

nslookup pythonskillset.com

This sends a DNS query for the domain's IP address. Wait a few seconds, then stop the capture (red square button).

Step 4: Observe the capture

The main window now shows a list of packets. You should see DNS packets with queries and responses, like this:

No.  Time  Source  Destination  Protocol  Info
1    0.00  192.168.1.10  8.8.8.8  DNS  Standard query 0x1234 A pythonskillset.com
2    0.02  8.8.8.8  192.168.1.10  DNS  Standard query response 0x1234 A 93.184.216.34

Step 5: Drill into a packet

Click on the DNS response packet. In the middle pane, expand the Domain Name System (response) section. You'll see the resolved IP address. The bottom pane shows the raw hex of the packet.

Step 6: Follow the UDP stream

To see the full query-response conversation, right-click on one DNS packet and choose Follow > UDP Stream. A new window shows the decoded conversation — you'll see the query and response as text.

Congratulations — you just captured and analyzed your first network conversation with Wireshark!

Compare options / when to choose what

Wireshark is the Swiss Army knife of packet analysis, but it has alternatives. Here's a quick comparison to help you choose the right tool for the job:

When to choose Wireshark: You need interactive analysis, deep protocol inspection, or you're troubleshooting a specific application conversation.

When to choose tcpdump: You're capturing on a remote server over SSH and need minimal overhead — then you'll pull the PCAP back and open it in Wireshark later.

When to choose TShark: You want to automate captures or parse packets in scripts (e.g., with Python).

Pro tip: In ethical hacking engagements, you often capture on a remote box with tcpdump (to avoid GUI overhead), then transfer the .pcap file to your workstation and open it in Wireshark for deep analysis. That combo gives you the best of both worlds.

Troubleshooting & edge cases

Even seasoned analysts hit snags. Here are the most common issues and how to fix them:

No packets captured

• Wrong interface selected: Check that you're capturing on the interface that actually carries the traffic (e.g., not loopback when you want external traffic).
• Capture filter too restrictive: If you used a capture filter, make sure it matches your traffic (e.g., tcp port 80 won't see HTTPS traffic on 443).
• Promiscuous mode disabled: On some systems, especially Wi-Fi, Promiscuous mode may be grayed out or not work. On wireless, you might only see your own traffic unless the card supports monitor mode.

Only seeing broadcast traffic

• Layer 2 isolation: On a modern switched network, Wireshark only sees broadcast packets and traffic to/from your own machine. To see all traffic, you need a port mirror (SPAN port) on the switch, or a network tap.

Capture file too large

• Use capture filters before starting to limit what's stored.
• Use ring buffers: In Capture Options, set a ring buffer with a size limit (e.g., 20 files of 100MB each). Wireshark will automatically rotate files, keeping only the latest.
• Increase buffer size in capture options to avoid dropped packets during bursts.

"Permission denied" when starting capture

On Linux, capturing requires root or membership in the wireshark group. Fix with:

sudo usermod -aG wireshark $USER
# log out and back in

Or run Wireshark with sudo (not recommended for GUI apps, but okay for labs).

HTTP traffic not dissected?

Wireshark decrypts HTTPS only if you provide the TLS private key. For HTTP (plaintext), everything should be visible. If you only see TLS, you're looking at encrypted traffic — you'll need to either capture at the point where it's decrypted (e.g., on the server) or configure SSL key logging in your browser.

What you learned & what's next

You now know how to use Wireshark to capture network traffic — from selecting an interface and applying capture filters, to analyzing packets and following streams. You also understand the difference between capture and display filters, and how to troubleshoot common issues like missing packets and permission errors.

This foundational skill unlocks the next lesson in the Ethical Hacking track: protocol analysis. Armed with Wireshark, you'll dissect TCP handshakes, spot unusual DNS queries, and even extract credentials from insecure traffic — all key techniques for reconnaissance and attack verification.

Remember the golden rule: always capture before and after an action to establish a baseline and clearly see the change. That habit will make you a methodical, evidence-driven ethical hacker.

Now go capture something — and make it count.