CyberGalaxy

Introduction to Wireshark – Capturing and Analysing Network Traffic

Wireshark is a powerful tool for capturing and analysing network packets. This guide will show you how to start capturing traffic, filter for relevant data, and understand basic protocols.

Step 1: Install Wireshark

Go to the Wireshark website and download the version for your OS. Follow the installer instructions and allow installation of WinPcap/Npcap (needed for packet capture on Windows).

Step 2: Capture Network Traffic

Open Wireshark, select your active network interface (Wi-Fi or Ethernet), and click Start Capturing Packets. You’ll see packets appearing in real-time.

Step 3: Use Filters

Focus on specific traffic using filters, e.g.,

  • http – only HTTP traffic
  • tcp.port == 80 – traffic on port 80
  • ip.addr == 192.168.1.10 – traffic from/to a specific IP

Step 4: Analyse a Packet

Click on a packet to view details. Expand the layers: Ethernet, IP, TCP/UDP, HTTP. Observe source/destination addresses, protocols, and payloads.

Step 5: Save Your Capture

Go to File → Save As and save your .pcap file. Reopen it later or share it for analysis exercises.

Interactive Exercise (Optional)

Upload a .pcap file and visually highlight interesting packets (HTTP requests, DNS queries). You could even create a small quiz: “Which packet contains a login request?” with multiple choice answers. Example files: Download Sample.