Wireshark

What It Does

Wireshark captures live network traffic and decodes it into human-readable protocol layers. It supports over 3,000 protocols and lets you inspect every byte of every packet that crosses a network interface. Whether you need to troubleshoot a connectivity issue or investigate suspicious traffic, Wireshark shows you exactly what is happening on the wire.

Why You Need It

Network analysis is a core skill in both IT support and cybersecurity. When an application is slow, a connection keeps dropping, or a host is communicating with an unknown IP, Wireshark gives you the ground truth that logs and dashboards cannot. It is referenced in the following Signal guides:

• SG-08 — Network troubleshooting and traffic analysis
• SG-10 — Packet capture and protocol inspection

CompTIA A+, Network+, Security+, and CySA+ all expect you to know how to capture and analyze packets. Wireshark is the industry standard tool for that.

How to Install It

Windows:

1. Download the installer from wireshark.org/download.html
2. Run the installer. When prompted, install Npcap (the packet capture driver) — Wireshark needs it to capture live traffic.
3. Accept defaults for the remaining prompts and finish the install.

Linux (Debian/Ubuntu):

sudo apt update && sudo apt install wireshark
sudo usermod -aG wireshark $USER

Log out and back in for the group change to take effect. This lets you capture without root.

macOS:

brew install --cask wireshark

Alternatively, download the .dmg from the official site. You will need to install the ChmodBPF helper to capture on interfaces.

How to Use It

1. Capture traffic on an interface

Launch Wireshark, select your active network interface (e.g., eth0, Wi-Fi), and click the shark fin icon to start capturing. Packets will stream in real time.

2. Apply display filters

The filter bar at the top lets you narrow down what you see. Some essential filters:

http                          # All HTTP traffic
tcp.port == 443               # All traffic on port 443 (HTTPS/TLS)
ip.addr == 192.168.1.50       # All traffic to/from a specific host
dns                           # DNS queries and responses
tcp.flags.syn == 1 && tcp.flags.ack == 0   # TCP SYN packets only (new connections)

3. Follow a TCP stream

Right-click any packet in a conversation, select Follow > TCP Stream. This reconstructs the full back-and-forth dialogue between client and server — useful for reading HTTP requests, SMTP exchanges, or spotting data exfiltration.

4. Export HTTP objects

Go to File > Export Objects > HTTP to list every file transferred over HTTP during the capture. You can save individual files or export them all. This is how you extract downloaded malware samples or leaked documents from a pcap.

5. Save and share a capture

Stop the capture (red square icon), then File > Save As to write a .pcapng file. This is the standard format that any analyst can open. Use capture filters (Capture > Options) to limit what gets recorded if you only need specific traffic:

host 10.0.0.5                 # Only traffic to/from this IP
port 80                       # Only port 80
net 192.168.1.0/24            # Only this subnet

Common Gotchas