Wireshark Tutorial: How to Capture & Analyze Network Traffic

A Wireshark tutorial teaches you to capture and analyse live network packets using the world’s most widely used open-source packet analyser. To get started: (1) install Wireshark, (2) select your active network interface, (3) click the blue shark-fin button to begin capturing, and (4) apply display filters to isolate the traffic you need.

• Key Takeaway 1: Wireshark captures raw packets at the network interface level, giving you a ground-truth view of what’s actually moving across your network.
• Key Takeaway 2: Display filters and capture filters are different things. Capture filters limit what gets recorded; display filters sort what you’ve already captured.
• Key Takeaway 3: Following a TCP stream is the fastest way to reconstruct a full conversation between two hosts, including credentials sent in cleartext.
• Key Takeaway 4: SOC L1 and L2 analysts use Wireshark to validate SIEM alerts, investigate lateral movement, and confirm whether an endpoint actually communicated with a suspicious IP.
• Key Takeaway 5: Wireshark is legal to use on networks you own or have explicit written permission to monitor. Using it on someone else’s network without consent is a criminal offence in most jurisdictions.

How to Capture Packets with Wireshark: A Step-by-Step Wireshark Tutorial

Download Wireshark from wireshark.org. It’s free, runs on Windows, macOS, and Linux, and the installer bundles Npcap on Windows so you don’t need to hunt for a separate packet-capture driver. On Linux, you’ll add your user to the wireshark group after install so you can capture without running as root. This Wireshark tutorial covers both beginner setup and SOC-level analysis workflows.

Selecting the Right Interface for Your Wireshark Packet Capture

When you open Wireshark, you’ll see a list of network interfaces with a live traffic sparkline next to each one. Pick the interface that’s actually moving data. On a typical Indian office laptop connected to Wi-Fi, that’s usually wlan0 on Linux or the named Wi-Fi adapter on Windows. Loopback (lo) is useful if you’re testing something running locally.

Double-click the interface and packets start appearing immediately. Each row shows the packet number, timestamp, source IP, destination IP, protocol, length, and a brief info summary. It looks chaotic at first. That’s normal. Filters fix this.

Capture Filters vs Display Filters: Wireshark Display Filter Examples

This is where most beginners trip up in any Wireshark tutorial for beginners. A capture filter is written in BPF (Berkeley Packet Filter) syntax and decides what Wireshark records to disk. A display filter is written in Wireshark’s own filter language and hides or shows packets you’ve already captured. You can’t retroactively apply a capture filter, but you can change display filters as many times as you like.

Use capture filters when you’re recording on a busy link and don’t want a 10 GB pcap. Use display filters for analysis. The table below shows the Wireshark display filter examples SOC analysts reach for most often.

Filter Type	Filter String	What It Shows
Display	http	All HTTP traffic
Display	ip.addr == 192.168.1.10	All traffic to or from a specific host
Display	tcp.port == 4444	Traffic on a specific port (e.g., common Metasploit default)
Display	dns	All DNS queries and responses
Display	tcp.flags.syn == 1 && tcp.flags.ack == 0	SYN packets only (useful for port-scan detection)
Display	frame contains "password"	Any packet whose payload contains the string “password”
Display	!(arp or dns or icmp)	Strips out noisy background traffic
Display	http.request.method == "POST"	HTTP POST requests only
Capture (BPF)	host 10.0.0.5	Only traffic involving one host (recorded to disk)
Capture (BPF)	port 80 or port 443	Web traffic only at capture time

According to the Wireshark project’s own documentation, the tool supports dissectors for over 3,000 network protocols, which is why it’s the default choice for protocol analysis in university networking labs across India’s IITs, NITs, and private engineering colleges alike.

Analysing a Suspicious pcap: Wireshark Packet Analysis in Practice

Let’s walk through a realistic scenario. You’re a SOC L1 analyst. Your SIEM fires an alert: an internal host at 10.0.0.22 has made 47 outbound connections in 90 seconds. You pull the pcap from your network tap or EDR and open it in Wireshark for packet analysis. This is exactly the kind of workflow covered in 3.0 University’s guide to SOC analyst tools and technologies.

Step 1: Isolate the Host

Type ip.addr == 10.0.0.22 into the display filter bar and press Enter. You’re now looking only at that host’s traffic. Sort by the Info column and look for repeated SYN packets with no corresponding SYN-ACK. That’s a classic sign of a port scan or a C2 beacon trying to reach a dead IP.

Step 2: Follow the TCP Stream

Right-click any interesting packet and choose Follow > TCP Stream. Wireshark reconstructs the full back-and-forth conversation in a readable window. If the session is unencrypted, you’ll see the raw data, including HTTP headers, form fields, usernames, and passwords. CERT-In’s incident response teams regularly use this technique to confirm data exfiltration over cleartext channels, as documented in CERT-In’s Annual Report 2023, which recorded over 13.9 lakh cybersecurity incidents in India that year.

Step 3: Check DNS for Beaconing

Apply the filter dns and look at the query names. Malware that uses domain generation algorithms (DGAs) produces DNS queries for random-looking domains: things like xk7q2mnt.net queried every 60 seconds. A legitimate browser doesn’t do that. If you see repetitive, evenly spaced DNS queries to weird domains, you’ve likely found a C2 callback. This kind of artefact analysis connects directly to threat hunting and malware analysis techniques used in advanced SOC roles.

Wireshark vs tcpdump: Which Should You Use?

tcpdump is a command-line tool that’s faster for capturing on headless servers or remote systems over SSH. Wireshark has a GUI, protocol dissectors, stream reconstruction, and a much gentler learning curve for beginners. In practice, SOC analysts often capture with tcpdump on a remote server and then open the resulting .pcap file in Wireshark for analysis. They’re complementary, not competing tools.

A 2023 survey by SANS Institute found that 85% of incident responders use Wireshark as part of their toolkit, making it the single most common packet analysis tool in professional security work. That’s not a coincidence. The GUI makes it fast to pivot, and the Wireshark filter language is expressive enough for complex queries.

If you want to build this Wireshark skill properly alongside SIEM, EDR, and SOAR workflows, 3.0 University’s SOC Analyst Certification Course walks you through real pcap labs with guided exercises. It’s built for learners who want to go from theory to hands-on in the shortest path possible.

Can Wireshark Detect Hackers? What SOC Analysts Actually Look For

Wireshark doesn’t automatically flag malicious traffic the way an IDS does. It’s a passive network traffic analysis tool. But in the hands of someone who knows what normal looks like, it’s extremely effective at surfacing abnormal behaviour. According to the Verizon 2024 Data Breach Investigations Report, 21% of breaches involved network-level evidence that was identified through traffic analysis, particularly in cases of lateral movement and data exfiltration.

Indicators You Can Spot in Wireshark

• Port scans: A burst of SYN packets from one source IP to many destination ports. Filter: tcp.flags.syn == 1 && tcp.flags.ack == 0.
• ARP spoofing: Multiple ARP replies claiming the same IP belongs to different MAC addresses. Filter: arp.duplicate-address-detected.
• Cleartext credentials: HTTP POST bodies or FTP/Telnet sessions containing usernames and passwords in plain text.
• DNS tunnelling: Unusually long DNS query strings used to exfiltrate data byte by byte inside DNS packets.
• Beaconing: Regular, clock-like outbound connections to the same external IP, typical of C2 malware.
• Large data transfers to unusual destinations: A host sending gigabytes to a cloud IP it’s never touched before.

Understanding these patterns also requires knowing what logs to correlate alongside pcap data. The 3.0 University article on what are logs in cybersecurity explains how firewall logs, endpoint logs, and packet captures work together to build a complete picture of an incident.

Is Wireshark Legal to Use in India?

Yes, with one firm condition: you must have authorisation to capture traffic on the network you’re monitoring. In India, unauthorised interception of network communications falls under Section 66 of the IT Act 2000 and can carry significant penalties. The Digital Personal Data Protection Act 2023 (DPDP Act) adds further obligations around handling any personal data captured in a pcap. On your own home lab, your company’s network (with written permission from IT/management), or a dedicated practice environment like a CTF lab, you’re completely fine. Never run Wireshark on a public Wi-Fi network to capture other people’s traffic. That’s illegal, and it’s also a terrible idea from a career perspective.

The Wireshark documentation itself is explicit about this: the tool is designed for network troubleshooting and security analysis by authorised personnel. Treat it like a scalpel, not a weapon.

Wireshark in SOC L1 and L2 Interviews

Traffic analysis comes up constantly in SOC analyst interviews, especially at Indian IT services firms like Infosys, Wipro, and TCS, as well as at dedicated security companies like Secureworks and Palo Alto Networks’ managed services teams. According to NASSCOM’s 2023 India Cybersecurity Report, India needs over 1 million trained cybersecurity professionals by 2025, and packet analysis skills are listed among the top five technical competencies employers test at interview. Common Wireshark interview questions include: “How would you identify a port scan in a pcap?”, “What filter would you use to find all DNS queries to a specific domain?”, and “Walk me through how you’d reconstruct an HTTP session.” Being able to answer these with specific Wireshark filter strings, not vague descriptions, separates candidates who’ve actually used the tool from those who’ve only read about it.

Frequently Asked Questions

How do I capture packets with Wireshark?

Open Wireshark, select the active network interface from the start screen, and double-click it to begin capturing. Packets appear in real time. Click the red square to stop. Save the capture as a .pcap or .pcapng file for later analysis. On Linux, add your user to the wireshark group first so you don’t need root privileges every time.

What are the most useful Wireshark display filter examples?

ip.addr == [IP] isolates a single host. tcp.flags.syn == 1 && tcp.flags.ack == 0 finds port scans. http.request.method == "POST" catches form submissions. dns shows all DNS activity. frame contains "password" searches packet payloads. These five Wireshark display filter examples cover the majority of what SOC analysts need for initial triage of a suspicious pcap.

Can Wireshark detect hackers?

Not automatically. Wireshark is a passive network traffic analysis tool, not an IDS. But an analyst who knows normal traffic patterns can use it to spot port scans, ARP spoofing, C2 beaconing, DNS tunnelling, and cleartext credential theft. The tool gives you the raw data; your knowledge of attacker techniques turns that data into actionable intelligence.

Is Wireshark legal to use in India?

Yes, on networks you own or have explicit written permission to monitor. In India, capturing traffic on someone else’s network without consent violates Section 66 of the IT Act 2000 and the DPDP Act 2023, and can result in criminal charges. Home labs, corporate networks with IT authorisation, and CTF environments are all legitimate. Always get permission in writing before capturing on any network you don’t personally own.

How do SOC analysts use Wireshark?

SOC analysts use Wireshark to validate SIEM alerts by confirming whether a flagged host actually communicated with a suspicious IP, to reconstruct attack sessions using TCP stream following, and to identify lateral movement or data exfiltration patterns in network captures. It’s often used alongside SIEM, EDR, and SOAR platforms rather than as a standalone solution.

What is the difference between Wireshark and tcpdump?

Wireshark provides a graphical interface with protocol dissectors, TCP stream reconstruction, and colour-coded packet rows, making it the preferred Wireshark tutorial tool for beginners and analysts doing deep pcap analysis. tcpdump is a command-line packet sniffer suited for headless servers and remote capture over SSH. Most SOC workflows use both: capture with tcpdump remotely, analyse the resulting pcap in Wireshark.

Packet analysis is a skill that compounds over time. The first pcap you open will feel overwhelming. The fiftieth will feel like reading a newspaper. The path between those two points is deliberate practice with real captures, not just watching tutorials. Set up a home lab, run some traffic, and start filtering. If you want a structured path with guided labs and SOC-specific scenarios, explore 3.0 University’s SOC Analyst Certification Course and start building the practical skills that actually show up in interviews.

Last updated: July 2026. Reviewed by the 3University editorial team.