What is Wireshark and why (and how) to use it

When the network is slow or something does not work, most people guess. They restart the router, swap cables, turn things off and on. Wireshark replaces guessing with facts: it shows exactly what is really happening on the network, packet by packet. It is one of the best-known tools in the hands of network administrators and security specialists, and the good news is that even an ordinary technician can handle its basics. Let us explain what it is, why it is worth knowing and how to get started.

What Wireshark is

Wireshark is a free and open-source packet analyzer (colloquially a sniffer). Put simply: it captures the network traffic passing through a chosen network interface of a computer and shows it in a readable form.

For this to make sense, one thing about networks. Everything you send over the network, whether it is the web, e-mail, a call or video, is not sent in one piece but split into small chunks called packets. Each packet has its own “envelope” (headers with information about where it comes from and goes to, and which protocol it uses) and its content. Wireshark intercepts these packets and breaks them down into parts, so you can see exactly who is communicating with whom, using which protocol, how fast and whether an error occurs.

It runs on Windows, macOS and Linux, is free and open, so anyone can download and use it.

How it works in short

Wireshark uses a library that can “listen” to the network card and copy the passing packets. When capturing, you choose an interface (for example WiFi or wired ethernet) and press start. From that moment packets pour into the list in real time.

Captured data can be saved to a file with the extension .pcap (or .pcapng) and opened later, on another computer, or sent to a colleague. This is very common in practice: you capture the traffic directly on the server with a simple tool and then analyse the resulting .pcap at your leisure in Wireshark.

One important note right at the start. On today’s switched networks you only see your own traffic from an ordinary port, not the traffic of neighbouring devices. A switch only sends each device what belongs to it. If you want to capture the traffic of the whole network, you have to enable port mirroring (port mirror, or SPAN on some brands) on the switch or insert a network tap (TAP) into the path. Without that Wireshark is not “broken”, the network is simply doing exactly what it should.

Why it is worth knowing Wireshark

Wireshark is not a toy for enthusiasts, it is a diagnostic tool that saves hours of guessing. Here is what it is most useful for:

• Troubleshooting a slow or dropping network. You see repeated transfers (retransmissions), lost packets, congestion or a device that overloads the network disproportionately. Instead of “the internet is kind of slow” you have a concrete cause.
• Diagnosing a specific service. A connection to a server, a printer or a database does not work? Wireshark shows whether the device responds at all, where the connection stalls and whether the fault is on the network side or the application.
• Verifying what an app really does. You can find out where a program connects, how often and whether it really encrypts the communication. That is valuable from a privacy and security standpoint too.
• Security and suspicious traffic. Unusual connections abroad, communication on non-standard ports or a device “talking” to something it should not. Wireshark is a basic tool in incident analysis.
• Learning how networks work. Nothing teaches protocols (DNS, DHCP, TCP, TLS) better than watching them happen live. For anyone who wants to understand networks, Wireshark is the best textbook.

How to get started with Wireshark, step by step

1. Installation. Download Wireshark from the official site and install it. On Windows the capture component (Npcap) is installed along with it, just click through it.
2. Choosing an interface. After launch you will see a list of network interfaces. Each has a line moving according to how much traffic flows through it. Choose the one you are interested in (usually WiFi or ethernet) and double-click to start capturing.
3. Capturing. Packets start pouring into the list. Do not be alarmed by the volume, we will narrow it down in the next step.
4. Filtering. In the top field (display filter) type what you want to see, for example dns or http. Only those packets will be shown. This is the most important skill, without filters you get lost in the traffic.
5. Analysing a connection. Right-click a packet and choose Follow > TCP Stream. Wireshark reassembles the whole connection, so you see the conversation between the devices as a whole, not in individual chunks.
6. Saving. Stop the capture with the red button and save the data to a .pcap for later via File > Save.

The filters you will use most often

The power of Wireshark lies in its filters. You do not need to know them by heart, these few are enough:

• ip.addr == 192.168.1.10 the traffic of a specific device (in both directions)
• dns only DNS queries and responses (great for spotting whether name resolution is failing)
• http unencrypted web traffic
• tcp.port == 443 HTTPS traffic (encrypted web)
• tcp.flags.syn == 1 attempts to establish a connection (useful when hunting for what connects where)
• tcp.analysis.retransmission repeated transfers, a clear sign of network problems
• dhcp IP address assignment (when a device does not “get” an address)

Filters can be combined with the operators and, or and not, for example ip.addr == 192.168.1.10 and dns. Wireshark also colours the rows: green is usually fine, black and red warn of errors, so problem spots stand out even without reading the detail.

What to watch out for

Wireshark is a powerful tool, and with power comes responsibility. Keep three things in mind:

Legality and ethics. Capturing someone else’s traffic without consent is against the law. Use Wireshark only on your own network, a network you manage or where you have the explicit consent of the owner. In a company, traffic monitoring should be covered by an internal policy.

Encryption. Most of today’s traffic is encrypted (HTTPS/TLS). That means you will see the metadata, that is who communicates with whom and how much data is transferred, but not the content itself. That is how it should be and Wireshark does not get around it. You can only read the content with old unencrypted protocols, which is another good reason not to use them.

A flood of data. In a few seconds you can gather tens of thousands of packets. Without a filter it is impossible to make sense of. Always be clear about what you are looking for first and narrow the traffic with a filter.

The command line: tshark, dumpcap and tcpdump

The graphical Wireshark comes with command-line siblings too. tshark is Wireshark without a window, controlled from the terminal, ideal for automation and for servers without a graphical environment. dumpcap is a small tool purely for capturing. And outside the Wireshark family there is the classic tcpdump, which is practically everywhere on Linux servers.

In practice this is often combined: you capture the traffic directly on the server (with tcpdump or tshark) into a .pcap file, then download it and comfortably analyse it in the graphical Wireshark on your computer. You get the best of both worlds, collection where the problem arises and analysis where you work best.

How we use it

When troubleshooting network problems at clients, Wireshark is one of the first tools we reach for once ordinary diagnostics are not enough. It helps us pinpoint exactly where the fault is, whether it is the network, a specific device or an application, and thus save time and money on blind trial and error. We also use it when verifying security, when we need to find out what is really happening on the network. That is precisely why we approach computer network management based on data, not guesswork.

Conclusion

Wireshark is a window into what is really happening on your network. It replaces guessing with facts, and although under the hood it is a very deep topic, its basics are surprisingly accessible. Installing it, choosing an interface, starting a capture and using a few filters can be done in one afternoon, and you will benefit from it right away. Use it responsibly, only where you have the right, and it will become a tool that saves you hours with every “strange” network problem.

This article is part of the overview Computer networks.