This article is Day 7 of a 100-day ethical hacking course, providing a comprehensive beginner's guide to Wireshark, the world's most widely used network protocol analyzer. It teaches students how to capture live network traffic, navigate Wireshark's three-pane interface, apply display filters to isolate specific packets, and understand why unencrypted protocols like HTTP expose sensitive data. The article emphasizes that seeing credentials transmitted in plaintext during a hands-on lab exercise creates visceral understanding of why encryption matters, moving beyond theoretical knowledge.
Key insights
Promiscuous mode captures all network packetsWireshark works by placing a network interface into promiscuous mode, which captures every packet crossing the interface regardless of destination address rather than just packets addressed to your machine. This requires elevated privileges (root or wireshark group membership) because it's a system-level operation. On switched networks, promiscuous mode only shows traffic reaching your port; capturing traffic between other devices requires a network tap, span/mirror port, or ARP poisoning.
Three-pane interface organizes packet data clearlyWireshark displays captured packets in three panels: Pane 1 (Packet List) shows each packet as a row with timestamp, source, destination, protocol, and summary; Pane 2 (Packet Details) displays an expandable tree of decoded OSI protocol layers for the selected packet; Pane 3 (Packet Bytes) shows raw hexadecimal with ASCII translation. Users click any packet row to inspect its details in Panes 2 and 3, building understanding of how protocols actually work.
Colour coding enables rapid traffic pattern recognitionWireshark automatically colour-codes packets by protocol and status: light blue for TCP, light purple for UDP, light green for HTTP, light orange for TCP connection setup/teardown flags (SYN/FIN/RST), light red/pink for TCP errors and resets, and black for TCP retransmissions. This visual system allows analysts to scan the packet list quickly and spot the traffic type they need without reading every row.
Display filters isolate specific traffic from thousands of packetsDisplay filters use expressions typed into the filter bar to show only matching packets from potentially thousands captured per minute. The article provides essential filters organized by category: protocol filters (http, dns, tcp, udp, icmp, tls, ftp, smtp), IP address filters (ip.addr, ip.src, ip.dst with CIDR notation support), port filters (tcp.port, tcp.dport), combined logic filters (and, or, not), and content searches (frame contains, http contains). The filter bar turns green when syntax is valid and red when invalid, with autocomplete assistance available.
Follow TCP Stream reassembles complete conversationsRight-clicking any packet and selecting Follow TCP Stream (or pressing Ctrl+Alt+Shift+T) opens a window showing the entire TCP connection reassembled in order, with red text representing client data and blue text representing server data. This feature lets analysts see complete request-response exchanges rather than individual packets, making it easier to understand what two hosts actually communicated. The stream window includes a Find function to search for keywords across the full conversation.
HTTP credentials transmit in plaintext unencryptedThe article demonstrates a hands-on lab exercise capturing HTTP login credentials in DVWA by filtering for POST requests and following the TCP stream to reveal username and password fields in cleartext: 'username=admin&password=password&Login=Login'. This practical exercise shows that anyone on the network running Wireshark can trivially capture credentials from HTTP forms, making this the most compelling evidence to force clients to migrate login forms to HTTPS.
tshark enables CLI packet analysis and automationtshark is the command-line version of Wireshark useful for headless (no GUI) server environments and scripting. Commands include tshark -i eth0 -w capture.pcap to capture to file, tshark -r capture.pcap -Y 'http' to read and filter a saved capture, and tshark -r capture.pcap -T fields -e http.request.uri to extract specific fields. This allows security professionals to automate packet analysis and integrate Wireshark functionality into larger security workflows.
PCAP is the universal standard capture formatPCAP (Packet Capture) files store network packet data and are read by multiple tools including Wireshark, tshark, tcpdump, Scapy, and Zeek. In security work, pcap files preserve evidence for forensic analysis, enable sharing captures with colleagues, support practice analysis on pre-captured traffic, and are commonly used in CTF competitions as challenges requiring analysts to find hidden data or credentials. Files are saved using File → Save As with .pcap extension.
Bottom line: Wireshark transforms network traffic from invisible background activity into readable, analyzable packets that reveal how protocols actually work and why encryption matters—seeing HTTP credentials in plaintext during a hands-on lab exercise creates the visceral understanding that makes security concepts concrete rather than theoretical. Mastering the three-pane interface, display filters, and TCP stream reconstruction makes Wireshark an essential tool that every security professional uses daily
The first time I used Wireshark on a live network and watched an HTTP login scroll past with a username and password sitting in plain text — I genuinely sat back in my chair. Not because I didn’t know it was theoretically possible. Because seeing it actually happen, in real time, on a real network, changes how you think about every unencrypted connection you’ve ever made.
Today you’re going to have that moment. In your own lab. With your own traffic. And you’ll understand — viscerally, not theoretically — exactly why the security concepts we’ve been building toward matter.
Wireshark is the world’s most widely used network protocol analyser. It’s free, open source, and pre-installed on Kali Linux. Security professionals, network engineers, incident responders, and students all use it daily. What it does is simple: it shows you every packet crossing a network interface, decoded into human-readable form.
By the end of today, you’ll know how to launch a capture, navigate Wireshark’s three-pane interface, write display filters to isolate specific traffic, follow a complete TCP conversation, and explain to anyone why HTTP is dangerous and HTTPS matters. These are professional-level skills. Let’s build them.
What Wireshark Does — And Why Every Security Professional Uses It
Your network interface is constantly sending and receiving data. Right now, as you read this, your machine is exchanging DNS queries, TCP keepalives, maybe some HTTP requests and encrypted HTTPS traffic. Most of this is invisible because your operating system only shows you the final result — a webpage, an email, a file download.
Wireshark makes it visible. It puts your network interface into promiscuous mode — a state where it captures every packet crossing the interface, not just the ones addressed to your machine. Every packet is captured, decoded by protocol, and displayed in a format you can read and analyse.
🔍
Network Troubleshooting
See exactly what’s happening when a connection fails, slows down, or behaves unexpectedly
🔬
Protocol Learning
See how TCP, DNS, HTTP, TLS actually work by watching real exchanges packet by packet
🐛
Malware Analysis
Observe what a suspicious process communicates — command-and-control servers, data exfil
⚠️
Security Demonstration
Show clients exactly how their HTTP traffic exposes credentials — nothing convinces like seeing it live
⚖️ Legal reminder: All Wireshark captures in this course happen within your own Kali VM and local lab network. Capturing traffic on networks you don’t own — including shared WiFi at cafes, hotels, or workplaces — without explicit permission is illegal under computer crime laws globally. The techniques we learn are for understanding and defending, not surveillance.
Launching Wireshark & The Three-Pane Interface
Wireshark is pre-installed on Kali Linux. Open a terminal and launch it — we’ll run it with sudo to ensure we have permission to put interfaces into promiscuous mode.
Launching Wireshark in Kali Linux
# Launch with root privileges (needed for promiscuous mode)
sudo wireshark &
# The & runs it in the background so your terminal stays usable
# If you see a permission error, add your user to wireshark group:
sudo usermod -aG wireshark $USER
newgrp wireshark
When Wireshark opens, you see the interface selection screen. Before starting a capture, you need to choose which network interface to listen on. You’ll recognise these from Day 5’s networking lesson.
Wireshark’s Three-Pane Interface — What Each Section Does
PANE 1
Packet List — The Stream of Captures
No.TimeSourceDestinationProtoLengthInfo
10.000192.168.56.18.8.8.8DNS73Standard query A google.com
20.0128.8.8.8192.168.56.1DNS89Standard query response A 142.250.185.46
Raw bytes — hex on left, ASCII translation on right. HTTP in red shows readable text.
Your First Live Capture — Start Here
Open Wireshark now in your Kali VM. On the welcome screen, you’ll see a list of network interfaces with a live activity graph. You want to select the interface that’s actually moving — the one with the wiggly line — because that’s where traffic is flowing.
Starting your first capture — step by step
# Step 1: Identify your active interface
ip a # Run this first to know your interface names
eth0: 192.168.56.101 ← this is likely your active interface in VirtualBox
# Step 2: In Wireshark, double-click your interface (eth0) to start
# Packets will immediately start flowing. This is normal — your
# machine is always sending background traffic (ARP, DNS, etc.)
# Step 3: Generate some interesting traffic — open a terminal alongside
# .pcap is the standard packet capture format — all tools read it
💡 You’ll see hundreds of packets immediately. Don’t panic — that’s normal. Your machine is constantly sending and receiving background traffic even when you’re not actively using any app. ARP requests, DNS TTL refreshes, TCP keepalives — all of it shows up. The display filter system (next section) is how you find the signal in this noise.
Colour Coding — Reading Traffic at a Glance
Wireshark colour-codes packets by protocol and status. Learning the default colour scheme lets you scan the packet list visually and immediately spot the traffic type you’re looking for. These are the colours you’ll see most often.
Light Blue — TCP traffic (general) — most web and service communication
Light Purple — UDP traffic — DNS, streaming, VoIP
Light Green — HTTP traffic — unencrypted web requests
Light Orange — TCP segments with SYN/FIN/RST flags — connection setup and teardown
Light Red / Pink — TCP errors, resets, connection problems — investigate these
Black (dark) — TCP retransmissions — packet was lost and resent
Display Filters — The Most Important Wireshark Skill
A live capture on an active network can generate thousands of packets per minute. Without filters, finding what you’re looking for is like searching for a word in a 1,000-page book without an index. Display filters are that index. Learn these and you’ll never feel lost in a capture again.
The filter bar is the long input field at the top of the Wireshark window. Type a filter expression and press Enter — the packet list instantly shows only matching packets. Clear the filter and all packets return. Nothing is deleted.
tcp.flags.syn == 1 and tcp.flags.ack == 0 # Pure SYN packets (port scan!)
💡 Filter autocomplete: As you type in the filter bar, Wireshark suggests completions. The bar turns green when your filter syntax is valid and red when it’s wrong. You don’t need to memorise exact syntax — start typing a protocol name and let autocomplete guide you.
Reading DNS, HTTP & ICMP Traffic — Protocol by Protocol
Let’s look at specific protocols through Wireshark’s lens. Generate each type of traffic in a terminal alongside Wireshark, filter to see it, then click into the packet details to understand what you’re seeing.
DNS — Watching Domain Resolution in Real Time
DNS in Wireshark — generate and filter
# Terminal — generate DNS traffic
nslookup securityelites.com
dig google.com MX
# Wireshark filter
dns
# What you’ll see in Pane 1:
12 0.001 192.168.56.101 → 8.8.8.8 DNS Standard query A securityelites.com
13 0.014 8.8.8.8 → 192.168.56.101 DNS Standard query response A 203.0.113.10
# Click packet 13 → Pane 2 → expand “Domain Name System (response)”
▼ Answers
securityelites.com: type A, class IN, addr 203.0.113.10
Time to live: 300 seconds
# You’re reading a real DNS response — the IP and its TTL
ICMP — Watching Ping Packets
ICMP in Wireshark — ping visualised
# Terminal
ping -c 4 8.8.8.8
# Wireshark filter
icmp
# You’ll see pairs — one request, one reply per ping
# Everything readable. Headers, user agent, even cookies if set.
Follow TCP Stream — See the Full Conversation
Individual packets show you one piece of a conversation. Follow TCP Stream reassembles all the packets in a TCP connection and shows you the complete exchange — request and response together, in the order they happened. This is one of the most powerful features in Wireshark for understanding what two hosts actually said to each other.
Follow TCP Stream — how to do it
# Step 1: Right-click any packet in an HTTP conversation
Right-click → Follow → TCP Stream
# Or click a packet and press Ctrl+Alt+Shift+T
# Step 2: A window opens showing the complete conversation
# ─── SERVER (blue) ───────────────────────────────────
HTTP/1.1 200 OK
Content-Type: text/html
<html><title>DVWA – Login</title>…
# Use “Find” in the stream window to search for keywords
Ctrl+F → “password” → highlights all matches
🔴 HTTP Credentials in Cleartext — The Demo That Changes Everything
This is the practical demonstration I want every student to run in their DVWA lab. It proves — visually, undeniably — why HTTP login forms expose credentials to anyone on the same network. Set up DVWA (we covered this in the lab setup guide) and follow these steps.
Capturing HTTP login credentials in DVWA — lab exercise
# Step 1: Ensure DVWA is running on your Kali VM
sudo service apache2 start
sudo service mysql start
# Open browser → http://localhost/dvwa/login.php
# Step 2: Start Wireshark capture on the loopback interface (lo)
# In Wireshark → select “Loopback: lo” → Start capture
# Set filter: http and tcp.port == 80
# Step 3: Submit the login form in your browser
# Username: admin Password: password
# Click Login
# Step 4: In Wireshark, find the POST request
http.request.method == “POST”
# Step 5: Right-click the POST packet → Follow → TCP Stream
# There it is. Username and password. In the clear.
# Anyone on the network running Wireshark would see this.
# This is why every login form must use HTTPS. No exceptions.
🎯 The lesson: This is not a theoretical attack. It is trivially easy to execute on any network where HTTP is used. In a professional engagement, showing a client this exact screenshot — their users’ credentials in Wireshark — is one of the most compelling pieces of evidence that forces remediation. Understanding the attack is what lets you make the argument that it needs to be fixed.
Saving Captures, Exporting & Professional Tips
Saving and exporting — professional workflow
# Save a full capture
File → Save As → capture_name.pcap
# .pcap is universal — all security tools read it
# Save only currently filtered packets (e.g. only HTTP)
File → Export Specified Packets → “Displayed” → Save
Stop the capture. Apply the filter icmp — do you see 4 request/reply pairs? Apply dns — can you see the google.com lookup?
2
Follow the HTTP TCP stream from example.com
Filter to http. Click the GET packet. Right-click → Follow → TCP Stream. Can you read the full HTTP response including the HTML? Screenshot this for your notes.
3
Write 3 display filters from scratch without looking at the guide
Try to write filters for: (1) traffic from your VM’s IP, (2) only DNS, (3) TCP port 80. Check the filter bar — does it turn green? If not, fix the syntax until it does.
★
Save your capture and open it with tshark
File → Save As → ~/Day7/first_capture.pcap tshark -r ~/Day7/first_capture.pcap -Y “dns” | head -20
You just used the CLI version of Wireshark — useful for scripting and headless servers. Does the output match what you saw in the GUI?
⭐ BONUS CHALLENGE — Detect a Port Scan
Start a Wireshark capture, then open a second terminal and run nmap -sS 127.0.0.1. Apply the filter tcp.flags.syn==1 and tcp.flags.ack==0. You will see every SYN packet Nmap sent — the exact fingerprint of a port scan. This is what a network defender’s IDS sees when a scan happens. Save a screenshot in your notes 📡
🔬
You can now see the invisible. Every packet on your network tells a story.
Seven days in — and you’ve just used the same tool that every network engineer, security analyst, and penetration tester relies on daily. Day 8 is where we first pick up an offensive tool: Nmap. Using everything you know about TCP, ports, and subnets, we’ll scan networks properly and understand exactly what every result means.
Why does Wireshark need root/administrator privileges?
Putting a network interface into promiscuous mode — capturing all traffic rather than just traffic addressed to you — requires elevated privileges because it’s a system-level operation. Without root, Wireshark can still capture packets addressed directly to your machine but will miss other traffic on the network segment. On Kali, adding your user to the wireshark group grants the necessary permissions without needing full root.
What is promiscuous mode?
Normally, a network interface only processes packets addressed to its own MAC address and drops everything else. Promiscuous mode tells the interface to capture every packet passing through — regardless of the destination address. This is what enables Wireshark to capture traffic beyond just your own. On a switched network, promiscuous mode still only shows traffic that reaches your port — to see all traffic between other devices, you’d need either a network tap, a span/mirror port on the switch, or to perform ARP poisoning first.
Can Wireshark capture traffic from other devices on my WiFi?
On a wired switched network, normally no — switches deliver traffic only to the intended port. On a WiFi network in monitor mode (not standard promiscuous mode), a compatible wireless adapter can capture all 802.11 frames including traffic from other devices. However, capturing other devices’ traffic without permission is illegal regardless of the technical method. For this course, all captures are within your own lab network.
What is a .pcap file and how is it used in security work?
PCAP (Packet Capture) is the standard file format for storing network packet data. Tools like Wireshark, tshark, tcpdump, Scapy, and Zeek all read and write pcap files. In security work, pcap files are used to: preserve evidence of network incidents for forensic analysis, share captures with colleagues for review, practice analysis skills on pre-captured traffic, and reproduce network behaviour in a lab. CTF competitions frequently provide pcap files as challenges — you’re expected to find hidden data or credentials inside them.
Wireshark is where networking stops being abstract. When students run their first capture and see the HTTP credentials scroll past — that’s the look I teach for. Not alarm. Understanding. Because once you’ve seen it, you know exactly why every security control we’ll build over the next 93 days actually matters.
Founder of Securityelites and creator of the SE-ARTCP credential. Working penetration tester focused on AI red team, prompt injection research, and LLM security education.
