How to Write Better AI Prompts: 7 Simple Rules

When you open a website, send a message or run a scan, data travels across the network in small pieces called packets. Wireshark is a free program that lets you capture those packets and look inside them. Network engineers use it to fix problems, security teams use it to investigate incidents, and students use it to finally see how networks really work.

In this guide you will learn what Wireshark does, how to capture your first packets safely, and how to use a few simple filters to make sense of the noise.

Golden rule: capture only traffic on your own computer or on a network you own or have clear permission to monitor. Capturing other people's traffic without permission is illegal in many places, even if it is "just to look".

What does Wireshark actually do?

Wireshark listens to a network interface, such as your Wi-Fi or Ethernet connection, and records the packets passing through it. For each packet it shows:

• Time: when the packet was captured.
• Source and destination: which address sent it and which one receives it.
• Protocol: the type of traffic, such as DNS, TCP, HTTP or TLS.
• Info: a short summary of what the packet is doing.

Before you start

Wireshark is included in Kali Linux. You can open it from the applications menu, or type wireshark in a terminal. On other systems, download it from the official site, wireshark.org.

If you haven't built a lab yet, read my guide on setting up a safe Kali practice lab first.

Step 1: Choose an interface

When Wireshark opens, you will see a list of network interfaces with small activity graphs. In a Kali virtual machine, the interface that shows moving lines is usually the one you want, often named eth0. Double-click it to start capturing.

Step 2: Create some traffic

The capture will be empty if nothing is happening. Open a terminal inside your VM and generate some simple traffic:

ping -c 4 example.com
nslookup example.com
curl http://example.com

These commands send a ping, ask for the website's address through DNS, and request a plain web page. All three are harmless. Then click the red square button in Wireshark to stop the capture.

Step 3: Read the packet list

Click any row. Wireshark shows details in the middle and bottom panes:

• Packet list (top): one line per packet.
• Packet details (middle): the layers of the packet, from Ethernet up to the application data. Click the arrows to expand them.
• Packet bytes (bottom): the raw data in hexadecimal.

Step 4: Use display filters

A busy network produces thousands of packets in seconds. The display filter bar at the top lets you show only what you need. Type a filter and press Enter:

dns
icmp
http
tcp.port == 443
ip.addr == 192.168.56.101

• dns shows only DNS lookups, where your computer asks "what is the address of this name?".
• icmp shows ping traffic.
• http shows plain, unencrypted web traffic.
• tcp.port == 443 shows traffic on port 443, which is used by HTTPS.
• ip.addr == 192.168.56.101 shows packets to or from one address. Replace it with an address from your own lab.

The filter bar turns green when the filter is valid and red when it is not.

What you can learn from a capture

• DNS in action. You can see your computer ask for example.com's address, and the answer coming back.
• The TCP handshake. Look for packets marked SYN, SYN/ACK and ACK. That is how two computers start a connection.
• Why HTTPS matters. With the http filter you can read the request and the page content in plain text. With HTTPS traffic you see that a connection exists, but the content is encrypted.

Why this is useful for security

Seeing real packets makes security ideas concrete. It explains why unencrypted logins are risky, why Nmap scans leave a trail in network logs, and how defenders spot strange behaviour. A good exercise is to run an Nmap scan against your own lab machine while Wireshark is capturing, then look at the packets that scan created.

Common beginner mistakes

• Capturing without permission. Stay on your own machine or lab.
• Getting lost in the noise. Use display filters early and often.
• Expecting to read everything. Most modern traffic is encrypted, so you will not see passwords or page content on HTTPS connections.
• Forgetting to stop the capture. Long captures create huge files. Stop, then save with File → Save As if you want to keep one.
• Choosing the wrong interface. If nothing appears, check you selected the one with activity.

Final thoughts

Wireshark turns invisible network activity into something you can read. Start by capturing your own traffic, learn three or four filters, and ask yourself what each packet is doing. After an hour of practice, topics like DNS, TCP and HTTPS will make much more sense.

Which would you like next: a guide to protecting your own accounts, or setting up a vulnerable practice VM? Tell me in the comments, and follow the blog for more guides on Kali Linux, programming, AI and crypto.