Wireshark

Wireshark lets you open the packets your computer sends and receives and read them one at a time. Start with a sample capture file from the Wireshark wiki instead of recording your own traffic. That way you practice without collecting anyone’s data.

This review is for people who are new to networking. After reading it, you can do the following:

• Open a sample capture file and read an HTTP request and response
• Use a display filter to show only the packets you want
• Record traffic on your own computer

##What Wireshark is for

The official guide lists these common uses:

• Network administrators troubleshoot network problems
• Security engineers examine security problems
• Developers debug protocol implementations
• Learners study how network protocols work

##Try it safely with a sample file

Your own captures can contain passwords and browsing history. For practice, use the files on the wiki’s SampleCaptures page.

1. Download the installer for your operating system from the official download page and install Wireshark.
2. On the SampleCaptures page, find the “HyperText Transport Protocol (HTTP)” section and download http.cap. It is a small file with one HTTP request and its response.
3. Start Wireshark and open http.cap with File>Open.
4. Select a row in the packet list. The pane below shows that packet layer by layer. Expand Ethernet, IP, TCP, and HTTP in turn to see how each layer wraps the next.

##Narrow the list with display filters

When there are many packets, type a condition into the display filter bar at the top of the window.

You can combine conditions with and and or. To see every protocol and field you can filter on, go to View>Internals>Supported Protocols.

##Record your own traffic

Once you are comfortable with the sample, try recording traffic on your own computer. Only capture on your own computer and on networks you manage.

On Windows, capturing packets requires Npcap. The Wireshark installer includes Npcap, so the default install settings add it for you. You can still open saved capture files without Npcap.

To limit what gets recorded in the first place, use a capture filter. Capture filters use the libpcap syntax, which is different from display filters. For example, tcp port 23 and host 10.0.0.5 records only telnet traffic to and from 10.0.0.5.

##You can’t read HTTPS content directly

HTTPS traffic is encrypted with TLS, so a capture alone does not show its contents. Wireshark can decrypt TLS only when you give it the secrets, such as a key log file. The wiki’s TLS page explains how.

##Cautions

##Read next

• cd ../nmapNmapfinds devices and open ports on a network
• cat ~/guides/lab-setup.mdHow to set up a safe test lab