Your first Wireshark capture: see DNS, TCP and HTTPS with your own eyes

Reading about protocols is useful. Watching them happen on your own network is what makes them stick. This lab takes about 30 minutes and needs only a laptop and the free packet analyser Wireshark. Only capture traffic on networks you own or have permission to monitor.

Step 1: install and start a capture

1. Download Wireshark from its official website and install it. On Windows, accept the Npcap component, which lets Wireshark capture packets.
2. Open Wireshark. You will see a list of interfaces with small activity graphs.
3. Double-click the interface you are using: Wi-Fi or Ethernet. Packets start scrolling immediately.
4. Open a browser and visit a website you have not visited today. Then press the red square to stop the capture.

Step 2: find the DNS lookup

Type dns in the display filter bar and press Enter. Look for a query for the website name you visited, then the response just below it. Expand the response in the middle pane and find the Answers section: that is the IP address your laptop will connect to. Notice it uses UDP port 53. Our note DNS explained covers what you are seeing.

Step 3: find the TCP three-way handshake

Note the IP address from the DNS answer. Use the filter ip.addr == x.x.x.x with that address, then look at the first three TCP packets:

• SYN from your laptop.
• SYN, ACK from the server.
• ACK from your laptop.

Look at the destination port: almost certainly 443, for HTTPS. You may instead see UDP 443, which means your browser used QUIC (HTTP/3), a newer transport that does not use the TCP handshake.

Step 4: look at TLS

Filter on tls.handshake.type == 1 to find the Client Hello. Expand it and find the Server Name Indication (SNI) extension: it usually shows the website name in plain text. Everything after the handshake shows as "Application Data": encrypted, and unreadable to Wireshark. This is exactly why HTTPS protects you on shared networks.

Step 5: useful filters to try

• arp: devices asking who owns an IP address on your local network.
• dhcp: renew your laptop's address and watch Discover, Offer, Request, Acknowledge.
• tcp.flags.reset == 1: connections being refused or torn down.
• icmp: run ping 8.8.8.8 and watch echo requests and replies.

What to write in your notes

For each step, take a screenshot and write one sentence explaining what the packet does and which OSI layer it belongs to. That gives you a mini portfolio piece and a revision sheet for CCNA or Network+. Our Wireshark lab note and OSI model note are good companions.

Common problems

• No interfaces shown: reinstall with Npcap, or run as administrator once.
• Too much traffic: close other apps, and always use a display filter.
• Cannot see other devices' traffic: normal on a switched or Wi-Fi network. You mostly see your own traffic and broadcasts.