Lab: capturing and reading traffic with Wireshark

Aim and what you need

The aim is to build the core skill of packet analysis: capturing the right traffic and recognising common protocols. You will use it for troubleshooting, security investigations and exams.

• Wireshark (free, open source) on your own Windows, macOS or Linux machine, or on a VM in your isolated lab.
• Permission: capture only on networks and devices you own or are authorised to monitor. Captures can contain personal data, cookies and sometimes passwords, so store and share them carefully.

Filters and what to look for

Steps

1. Install Wireshark. On Linux, allow your user to capture without running the whole program as root, then log out and in again.
2. List interfaces and pick the one that carries your traffic (usually Wi-Fi or Ethernet).
3. Start a capture, then generate traffic: clear the ARP cache if you can, look up a name and open a website.
4. Stop the capture after about 30 seconds and save it as lab-web.pcapng.
5. Apply each display filter from the table and find the packets in Figure 3. Right-click a TCP packet and choose Follow, TCP Stream.
6. Open Statistics, Conversations and Statistics, Protocol Hierarchy to see the big picture.

sudo apt install wireshark
sudo usermod -aG wireshark $USER
tshark -D
tshark -i eth0 -f "port 53 or port 443" -a duration:30 -w lab-web.pcapng
nslookup example.com
curl -I https://example.com
tshark -r lab-web.pcapng -Y "dns" -T fields -e dns.qry.name
tshark -r lab-web.pcapng -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name

On Windows, run arp -d * from an administrator prompt before browsing to see fresh ARP traffic; on Linux use sudo ip neigh flush all.

Verify, troubleshoot and clean up

Success means you can point to: an ARP request and reply for your gateway; a DNS query and answer for example.com; a SYN, SYN-ACK, ACK sequence; and a TLS Client Hello showing the server name, after which the data is unreadable because it is encrypted. Write down the source port of your connection and find it in all three TCP packets.

• No interfaces listed: the capture driver (Npcap on Windows) is missing, or on Linux your user is not yet in the wireshark group.
• Only your own traffic on Wi-Fi: that is normal. Switches and Wi-Fi only deliver frames meant for you; seeing other hosts needs a mirror (SPAN) port on a switch you manage.
• Capture is huge: use a capture filter or a duration limit next time.
• Names show as raw IPs: name resolution is off in View, Name Resolution, which is usually what you want.

Clean up by deleting captures you no longer need, especially any that contain logins or personal data. Use the port lookup tool to identify unfamiliar port numbers you see.