When you open Wireshark, the main screen will be divided into two broad section: “Open” and “Capture”ġ: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 There is one major requirement before getting started with any packet sniffer, which it to have a solid understanding of the TCP/IP Model, which should be pretty obvious as to why? It is because Wireshark shows packets carrying data from all the various layers from one system onto another system, which you, as an expert (or an enthusiast) are going to analyze. And we are going to learn the GUI version as it is easier to learn and understand. There are two ways to use Wireshark: Using the GUI or the CLI. Colourise packets for easy identificationĪs a competent penetration tester, network security engineer or a network adminitrator, you should be well-versed with Wireshark (or any packet sniffer in general).Filter packets based on (multiple) criteria.Display detailed protocol information of each packet.Import packets from text files containing hex dumps of packet data.

It literally just dumps each and every packet going across the network. Before anything else, know this: Wireshark is an extremely powerful tool! It allows one to see what’s happening in a network, and it does this by showing all the traffic on an interface.

Wireshark capture filter port