How to Use Wireshark: Practical Beginner Guide

In one line

Wireshark records the network conversations your computer has and lets you read them, so you can see exactly what data is flowing and whether it is protected.

What this is, for a beginner

Wireshark is the standard network protocol analyser: it captures the packets travelling across a network interface and presents them in a readable, filterable form. Network engineers use it to diagnose problems, and security people use it to understand exactly what an application sends, to spot sensitive data in transit, and to see why unencrypted protocols are dangerous.

The two skills that make Wireshark useful are capturing on the right interface and filtering the flood of packets down to what matters. Display filters let you isolate a protocol, a host, or a conversation, and Follow Stream reassembles a scattered exchange into readable form. This guide practises both on traffic you generate yourself.

The legal lab we use: Your own machine and lab network

Capture only traffic on networks you own or are authorized to monitor. Practise against your own devices and lab, never someone else's network.

Your own machine and lab network project page →

Full walkthrough: exploiting it step by step

Step 1 — Start a capture

Open Wireshark, pick your active network interface, and start capturing. You will immediately see a live list of packets.

Expected result: Packets stream into the capture window as your machine communicates on the network.

Step 2 — Filter to what matters

Raw capture is overwhelming, so apply a display filter to isolate a protocol. Filter for HTTP to focus on unencrypted web traffic you generate against your own lab.

display filter

http

Expected result: Only HTTP packets remain visible, cutting the noise down to the conversation you care about.

Step 3 — Generate and capture a plaintext login

Against your own lab app over plain HTTP, submit a test login. Wireshark captures the request carrying the credentials, because HTTP does not encrypt them.

display filter

http.request.method == "POST"

Expected result: The POST request appears, and inspecting it reveals the submitted username and password in clear text.

Step 4 — Follow the stream

Right-click a packet and choose Follow then HTTP Stream to reassemble the full exchange into a single readable view rather than scattered packets.

Wireshark

Right-click → Follow → HTTP Stream

Expected result: The complete request and response appear together, with the plaintext credentials plainly visible in the request body.

Step 5 — Repeat over HTTPS and compare

Now do the same against an HTTPS endpoint you own. The equivalent traffic is encrypted, so the credentials are no longer readable, demonstrating exactly what TLS protects.

display filter

tls

Expected result: The HTTPS exchange shows only encrypted TLS records; the password that was readable over HTTP is now unreadable ciphertext.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

For defenders, unexpected plaintext protocols on the network (HTTP, Telnet, FTP) are findings; Wireshark or its command-line sibling helps confirm what is actually in use.
Signs of a man-in-the-middle, such as unexpected ARP changes, can be observed in capture and are worth alerting on.
Capturing sample traffic is a quick way to verify that sensitive services are genuinely using encryption.

How to fix it

Encrypt everything in transit: HTTPS, SSH instead of Telnet, and TLS for email and file transfer, so captured traffic is useless to an attacker.
Enable HTTPS-only behaviour and remove or restrict legacy plaintext services.
Segment and monitor networks so an attacker cannot easily position themselves to capture traffic in the first place.
Use a VPN on untrusted networks to wrap traffic in an encrypted tunnel.

Common beginner mistakes

Capturing on the wrong interface and seeing nothing relevant; confirm which interface carries your traffic.
Drowning in packets by not filtering; learn a handful of display filters early.
Expecting to read HTTPS content; TLS is exactly what stops that, which is the lesson.
Capturing traffic on networks you do not own or are not authorized to monitor, which can be illegal.

FAQ

Is it legal to use Wireshark?

Wireshark is a legitimate diagnostic tool. Capturing traffic is only legal on networks you own or are authorized to monitor; capturing other people's traffic without permission is illegal in most places. Practise on your own devices and lab.

What is the difference between a capture filter and a display filter?

A capture filter limits what Wireshark records in the first place, which is useful for large captures. A display filter narrows what you see from an existing capture without discarding data. Beginners usually start with display filters like http or tls.

Can Wireshark read HTTPS traffic?

Not the contents, by design. HTTPS encrypts the data, so you see only the encrypted TLS records. That is precisely why moving from HTTP to HTTPS protects credentials, and demonstrating the difference is a great learning exercise.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Use Nmap How to Use Hydra How to Exploit Broken Authentication