B
%Start How to Use Wireshark: A Complete Tutorial GA
S
REGULAR Menu Lifewire Tech for Humans Newsletter! Search Close GO Internet, Networking, & Security > Home Networking 504 504 people found this article helpful
visibility
440 views
thumb_up
24 likes
A
He has 25+ years' experience as a programmer and QA leader, and holds several Microsoft certifications including MCSE, MCP+I, and MOUS. He is also A+ certified. lifewire's editorial guidelines Updated on July 8, 2020 Tweet Share Email Tweet Share Email Home Networking The Wireless Connection Routers & Firewalls Network Hubs ISP Broadband Ethernet Installing & Upgrading Wi-Fi & Wireless
What to Know
Wireshark is an open-source application that captures and displays data traveling back and forth on a network.
thumb_up
15 likes
D
Because it can drill down and read the contents of each packet, it's used to troubleshoot network problems and test software. Instructions in this article apply to Wireshark 3.0.3 for Windows and Mac.
thumb_up
10 likes
E
What Is Wireshark
Originally known as Ethereal, Wireshark displays data from hundreds of different protocols on all major network types. Data packets can be viewed in real-time or analyzed offline.
thumb_up
5 likes
S
Wireshark supports dozens of capture/trace file formats, including CAP and ERF. Integrated decryption tools display the encrypted packets for several common protocols, including WEP and WPA/WPA2.
thumb_up
22 likes
E
How to Download and Install Wireshark
Wireshark can be downloaded at no cost from the Wireshark Foundation website for both macOS and Windows. You'll see the latest stable release and the current developmental release.
thumb_up
24 likes
H
Unless you're an advanced user, download the stable version. During the Windows setup process, choose to install WinPcap or Npcap if prompted as these include libraries required for live data capture. You must be logged in to the device as an administrator to use Wireshark.
thumb_up
27 likes
E
In Windows 10, search for Wireshark and select Run as administrator. In macOS, right-click the app icon and select Get Info.
thumb_up
41 likes
L
In the Sharing & Permissions settings, give the admin Read & Write privileges. The application is also available for Linux and other UNIX-like platforms including Red Hat, Solaris, and FreeBSD.
thumb_up
0 likes
D
The binaries required for these operating systems can be found toward the bottom of the Wireshark download page under the Third-Party Packages section. You can also download Wireshark's source code from this page.
thumb_up
4 likes
E
How to Capture Data Packets With Wireshark
When you launch Wireshark, a welcome screen lists the available network connections on your current device. Displayed to the right of each is an EKG-style line graph that represents live traffic on that network. To begin capturing packets with Wireshark: Select one or more of networks, go to the menu bar, then select Capture.
thumb_up
19 likes
S
To select multiple networks, hold the Shift key as you make your selection. In the Wireshark Capture Interfaces window, select Start.
thumb_up
2 likes
O
There are other ways to initiate packet capturing. Select the shark fin on the left side of the Wireshark toolbar, press Ctrl+E, or double-click the network.
thumb_up
16 likes
L
Select File > Save As or choose an Export option to record the capture. To stop capturing, press Ctrl+E. Or, go to the Wireshark toolbar and select the red Stop button that's located next to the shark fin.
thumb_up
1 likes
E
How to View and Analyze Packet Contents
The captured data interface contains three main sections: The packet list pane (the top section)The packet details pane (the middle section)The packet bytes pane (the bottom section)Packet List
The packet list pane, located at the top of the window, shows all packets found in the active capture file. Each packet has its own row and corresponding number assigned to it, along with each of these data points: No: This field indicates which packets are part of the same conversation. It remains blank until you select a packet.Time: The timestamp of when the packet was captured is displayed in this column.
thumb_up
8 likes
L
The default format is the number of seconds or partial seconds since this specific capture file was first created.Source: This column contains the address (IP or other) where the packet originated.Destination: This column contains the address that the packet is being sent to.Protocol: The packet's protocol name, such as TCP, can be found in this column.Length: The packet length, in bytes, is displayed in this column.Info: Additional details about the packet are presented here. The contents of this column can vary greatly depending on packet contents.
thumb_up
19 likes
J
To change the time format to something more useful (such as the actual time of day), select View > Time Display Format. When a packet is selected in the top pane, you may notice one or more symbols appear in the No. column.
thumb_up
6 likes
W
Open or closed brackets and a straight horizontal line indicate whether a packet or group of packets are part of the same back-and-forth conversation on the network. A broken horizontal line signifies that a packet is not part of the conversation.
Packet Details
The details pane, found in the middle, presents the protocols and protocol fields of the selected packet in a collapsible format.
thumb_up
11 likes
D
In addition to expanding each selection, you can apply individual Wireshark filters based on specific details and follow streams of data based on protocol type by right-clicking the desired item.
Packet Bytes
At the bottom is the packet bytes pane, which displays the raw data of the selected packet in a hexadecimal view. This hex dump contains 16 hexadecimal bytes and 16 ASCII bytes alongside the data offset.
thumb_up
48 likes
L
Selecting a specific portion of this data automatically highlights its corresponding section in the packet details pane and vice versa. Any bytes that cannot be printed are represented by a period.
thumb_up
5 likes
L
To display this data in bit format as opposed to hexadecimal, right-click anywhere within the pane and select as bits.
How to Use Wireshark Filters
Capture filters instruct Wireshark to only record packets that meet specified criteria. Filters can also be applied to a capture file that has been created so that only certain packets are shown.
thumb_up
41 likes
L
These are referred to as display filters. Wireshark provides a large number of predefined filters by default.
thumb_up
11 likes
E
To use one of these existing filters, enter its name in the Apply a display filter entry field located below the Wireshark toolbar or in the Enter a capture filter field located in the center of the welcome screen. For example, if you want to display TCP packets, type tcp. The Wireshark autocomplete feature shows suggested names as you begin typing, making it easier to find the correct moniker for the filter you're seeking.
thumb_up
31 likes
M
Another way to choose a filter is to select the bookmark on the left side of the entry field. Choose Manage Filter Expressions or Manage Display Filters to add, remove, or edit filters. You can also access previously used filters by selecting the down arrow on the right side of the entry field to display a history drop-down list.
thumb_up
50 likes
D
Capture filters are applied as soon as you begin recording network traffic. To apply a display filter, select the right arrow on the right side of the entry field.
Wireshark Color Rules
While Wireshark's capture and display filters limit which packets are recorded or shown on the screen, its colorization function takes things a step further: It can distinguish between different packet types based on their individual hue.
thumb_up
43 likes
L
This quickly locates certain packets within a saved set by their row color in the packet list pane. Wireshark comes with about 20 default coloring rules, each can be edited, disabled, or deleted.
thumb_up
1 likes
G
Select View > Coloring Rules for an overview of what each color means. You can also add your own color-based filters.
thumb_up
31 likes
L
Select View > Colorize Packet List to toggle packet colorization on and off.
Statistics in Wireshark
Other useful metrics are available through the Statistics drop-down menu.
thumb_up
15 likes
J
These include size and timing information about the capture file, along with dozens of charts and graphs ranging in topic from packet conversation breakdowns to load distribution of HTTP requests. Display filters can be applied to many of these statistics via their interfaces, and the results can be exported to common file formats, including CSV, XML, and TXT.
thumb_up
40 likes
I
Wireshark Advanced Features
Wireshark also supports advanced features, including the ability to write protocol dissectors in the Lua programming language. Was this page helpful?
thumb_up
20 likes
C
Thanks for letting us know! Get the Latest Tech News Delivered Every Day
Subscribe Tell us why! Other Not enough details Hard to understand Submit More from Lifewire How to Monitor Network Traffic Task Manager (What It Is & How to Use It) CAP File (What It Is and How to Open One) How to Use Microsoft Word How to Use the Netstat Command on Mac How to Use Night Light in Windows 10 How to Use the Netstat Command TCP vs.
thumb_up
28 likes
J
UDP How to Highlight and Find Duplicates in Google Sheets How to Use the iPhone Camera Network MTU vs. Maximum TCP How to Freeze Column and Row Headings in Excel How to Use the Round Function in Excel How Web Browsers and Web Servers Communicate How to Send iMessages With iPhone Text Effects How to Set Up PPPoE Internet Access Newsletter Sign Up Newsletter Sign Up Newsletter Sign Up Newsletter Sign Up Newsletter Sign Up By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
thumb_up
3 likes
Similar Discussions
-
Kurt Angle names three top WWE Superstars he d come out of retirement to wrestle
-
Roger Federer arrives in London for the Laver Cup
-
Andy Roddick acknowledges Rafael Nadal s kind actions following the Spaniard s R4 loss at US Open
-
I will never be her Coco Gauff shuts down comparisons with Serena Williams
-
Wrestling fans hilariously reacts after former WWE Superstar turns heel again at AEW All Out pay per view
-
What Are the Balls on the Table in House of the Dragon ?
-
Is Marlyne Barrett From Chicago Med Sick? Details on the Star
-
Messages APK Download for Android APKfun com
-
Barcelona Hotels APK Download for Android
-
Samurai Ninja horse fight APK Download for Android
-
Tabella Catholic App APK Download for Android
-
Pricepirates Price Comparison APK Download for Android
-
Roomify APK Download for Android
-
Conference USA APK Download for Android
-
Хоккейный клуб «Барыс» APK Download for Android
-
Los sindicatos convocan tres d as de huelga en Renfe por el bloqueo en la negociaci n del convenio Comisiones Obreras Ugt
-
Sacheen Littlefeather famous for 1973 Oscar speech made up her indigenous narrative sisters claim B Human Interest
-
Here s how to get an early start on ringing in the 2022 Magic City Classic Mcc 22 River All
-
YouTuber More Plates More Dates calls out Logan Paul s PRIME Hydration marketing Dexerto
-
YouTuber Trevor Jacob stripped of pilot certificate after allegedly crashing plane on purpose
-
Destiny 2 The Best Rolls for the Austringer Hand Cannon
-
I Highlight What s Wrong With Our Society By Creating Digital Art 24 Pics
-
First Galaxy S23 design leak shows a floating camera bump Digital Trends
-
Manifest Season 4 Release Date Trailer Latest News Cast and More TV Guide
-
How to Save Passwords in Chrome for iOS
-
How to Make a Private Story on Snapchat
-
How to Fix a Kindle That s Frozen
-
What Is a CRX File?
-
T Mobile Gives an Update on its Cyberattack Investigation
-
RAW File What It Is How to Open One