Wireshark Tutorial for Beginners (2026)

Wireshark is the world's most popular network protocol analyzer. It captures the traffic flowing across a network and lets you inspect it packet by packet — invaluable for troubleshooting, learning how protocols work, and security analysis.

⚠️ Only capture traffic on networks you own or are authorized to monitor. Capturing other people's traffic can be illegal.

What Wireshark shows you

Every conversation between computers is made of packets. Wireshark decodes them so you can see the source, destination, protocol, and contents of each one — DNS lookups, HTTP requests, TCP handshakes, and more.

Step 1 — Capture

1. Open Wireshark and pick a network interface (your Wi-Fi or Ethernet adapter).
2. Click the blue shark-fin to start capturing.
3. Generate some traffic (load a website), then stop.

You'll see a live list of packets scrolling by.

Step 2 — The three panes

• Packet list (top) — one row per packet.
• Packet details (middle) — the selected packet broken down by protocol layer.
• Packet bytes (bottom) — the raw hex/ASCII.

Click any packet and expand the layers (Ethernet → IP → TCP → application) to see how data is wrapped.

Step 3 — Display filters (the superpower)

Raw captures are overwhelming. Display filters cut to what matters:

http                 # only HTTP traffic
dns                  # only DNS
ip.addr == 10.0.0.5  # to/from a specific host
tcp.port == 443      # HTTPS
http.request.method == "POST"

Combine them with and / or. This is 90% of practical Wireshark.

Step 4 — Follow a stream

Right-click a packet → Follow → TCP Stream to reassemble an entire conversation into readable form. Brilliant for seeing a full HTTP request/response.

Why it matters for security

Wireshark teaches you what "normal" looks like — so abnormal stands out. You'll see a DNS query, a TLS handshake, or unencrypted credentials crossing the wire. That intuition is foundational for both attackers and defenders.

Where it fits

Wireshark pairs naturally with Nmap (map the network, then watch its traffic). To learn packet analysis as part of a full curriculum, start free at the Pentevo Academy.