▶Prefer to watch? This video runs the guide's main commands on a real Ubuntu 24.04 machine, with on-screen captions and no voiceover. Click to play, or watch it on YouTube. It is part of the Networking and Firewalls playlist.
wireshark [options] [file] | tshark [options]
wireshark capture.pcapng
Wireshark is the most widely used network protocol analyzer. It captures packets from a network interface (or opens a saved
capture) and shows them decoded, layer by layer, with color coding, powerful filters and built-in analysis tools. tshark is its
command-line twin, ideal for servers with no screen, scripts and quick summaries. Use it to answer questions like "is the traffic
arriving?", "why is this connection slow?", "what is this device talking to?" and "why does this TLS handshake fail?".
Only capture on networks you own or are explicitly authorized to monitor. Captures can contain passwords, cookies, private messages
and personal data. See the "Privacy and legal" section, and the tcpdump sheet for capturing on servers.
Install
sudo apt install wireshark tshark # Debian/Ubuntu. Answer YES when asked whether non-root users should be able to capture
sudo dpkg-reconfigure wireshark-common # ask that question again
sudo usermod -aG wireshark $USER # let your account capture (log out and back in afterward)
sudo dnf install wireshark wireshark-cli # Fedora/RHEL family (then: sudo usermod -aG wireshark $USER)
brew install --cask wireshark # macOS (installs the ChmodBPF helper so you do not need sudo)
Windows: download the installer from wireshark.org. It includes Npcap, the capture driver
wireshark --version tshark --version # check what you have (4.x is current)
Running the GUI as root (sudo wireshark) works but is not recommended. Use the wireshark group instead.
The tools in the package
wireshark The graphical analyzer tshark Command-line capture and analysis
dumpcap The capture engine used by both (lightweight, safe to run for long captures)
capinfos Summary of a capture file (size, time span, packet count) editcap Cut, split, convert and edit capture files
mergecap Merge several captures into one text2pcap Turn a hex dump into a capture file
rawshark Analyze a raw packet stream reordercap Sort packets by time randpkt Make sample traffic (for testing)
File formats: .pcapng is the modern default (interface info, comments, multiple interfaces). .pcap is the classic tcpdump format. Wireshark reads both.
Your first capture (GUI)
1. Start Wireshark. The main screen lists interfaces with a live activity graph. Double-click the one with traffic (eth0, wlan0, enp3s0...)
"any" captures on all Linux interfaces at once (headers differ: "Linux cooked capture")
2. To capture ONLY what you need, type a CAPTURE filter in the box above the interface list BEFORE you start (for example host 10.0.0.5 and port 443)
3. Reproduce the problem (load the page, run the command)
4. Stop the capture (red square, or Ctrl+E)
5. Type a DISPLAY filter in the green bar at the top to focus on what matters (for example http.response.code >= 400) and press Enter
6. Save with File > Save As (pcapng). Add a comment with Statistics > Capture File Properties
The window has three panes: the PACKET LIST (one row per packet), PACKET DETAILS (the selected packet as an expandable protocol tree) and PACKET BYTES (raw hex).
Click a field in the details pane and its bytes highlight. The status bar shows the field name (like tcp.flags.syn): right-click it > Apply as Filter to build filters.
The filter bar color: green = valid, red = syntax error, yellow = valid but probably not what you meant (like "ip.addr != x" on some versions).
Capture filters vs display filters (the #1 confusion)
CAPTURE filters (BPF syntax, same as tcpdump) Applied BEFORE packets are saved. Packets that do not match are gone forever. Fast, keeps files small
DISPLAY filters (Wireshark's own syntax) Applied to packets already captured. Nothing is lost, and you can change them any time
They have DIFFERENT syntax. "host 10.0.0.5" is a capture filter. "ip.addr == 10.0.0.5" is a display filter.
Rule: use a capture filter when the network is busy or the file would be huge, and display filters for everything else.
Capture filter examples (BPF)
host 10.0.0.5 # to or from a host src host 10.0.0.5 dst host 10.0.0.5
net 192.168.1.0/24 # a network ether host aa:bb:cc:dd:ee:ff by MAC
port 443 # TCP or UDP port tcp port 80 udp port 53 portrange 8000-8100
tcp # a protocol: tcp, udp, icmp, arp, ip, ip6
not port 22 # exclude SSH (do this when capturing over SSH)
host 10.0.0.5 and port 443 # combine with and, or, not (and parentheses, quoted)
(port 80 or port 443) and net 10.0.0.0/8
tcp[tcpflags] & (tcp-syn) != 0 # packets with the SYN flag
greater 1400 # large packets less 100 small packets
vlan and host 10.0.0.5 # VLAN-tagged traffic
Set it in the capture options (Capture > Options > the filter box) or with -f in tshark.
Display filter basics
ip.addr == 10.0.0.5 # source OR destination is this IP
ip.src == 10.0.0.5 ip.dst == 10.0.0.5
ip.addr == 10.0.0.0/24 # a whole network
ipv6.addr == 2001:db8::1
tcp.port == 443 # either TCP port tcp.srcport == 443 tcp.dstport == 443
udp.port == 53
tcp.port in {80 443 8080} # any of several values
eth.addr == aa:bb:cc:dd:ee:ff # a MAC address vlan.id == 10
frame.len > 1000 # packet size tcp.len > 0 packets that actually carry data
frame.time_delta > 1 # a gap of more than 1 second since the previous packet
frame contains "password" # the text appears anywhere in the packet (case-sensitive)
tcp contains "GET /login" http.host contains "example" # "contains" is case-sensitive: use matches "(?i)example" for regex
http.request.uri matches "\.(jpg|png)$" # regular expression match
tcp.stream eq 7 # one TCP conversation (numbers are shown in the details pane)
Combine: && (and) || (or) ! (not) and parentheses Or use the words: and or not
ip.addr == 10.0.0.5 && tcp.port == 443
!(arp || icmp || dns) # hide noise
!(ip.addr == 10.0.0.5) # everything except this host (safe form: avoid ip.addr != 10.0.0.5 , whose meaning has changed between versions)
Comparison: == != > < >= <= contains matches in. Slices: eth.src[0:3] == 00:11:22
A protocol name alone shows all packets of that protocol: http dns tls ssh arp icmp dhcp tcp udp smb2 ftp smtp ntp ldap
Right-click any field in the details pane > Apply as Filter > Selected / Not Selected / ...and Selected. The easiest way to learn the field names.
The Display Filter Reference (wireshark.org/docs/dfref/) lists every field.
Filters for troubleshooting
TCP health
tcp.flags.syn == 1 && tcp.flags.ack == 0 # new connection attempts (SYN) tcp.flags.syn == 1 && tcp.flags.ack == 1 server answers (SYN-ACK)
tcp.flags.reset == 1 # resets: refused or aborted connections
tcp.flags.fin == 1 # connections closing
tcp.analysis.flags # every packet Wireshark thinks is a TCP problem
tcp.analysis.retransmission # retransmitted packets (loss, congestion or a slow link)
tcp.analysis.fast_retransmission tcp.analysis.spurious_retransmission
tcp.analysis.duplicate_ack # the receiver is missing something
tcp.analysis.lost_segment # a gap in the sequence numbers (packet loss on the capture path)
tcp.analysis.zero_window # the receiver's buffer is full: it cannot take data (slow application or host)
tcp.analysis.window_full # the SENDER filled the receiver's window
tcp.analysis.out_of_order
tcp.analysis.initial_rtt > 0.1 # handshake round-trip time over 100 ms
tcp.time_delta > 1 # gaps inside one TCP stream (needs Preferences > Protocols > TCP > "Calculate conversation timestamps")
DNS
dns dns.flags.response == 0 (queries) dns.flags.response == 1 (responses)
dns.flags.rcode != 0 # failures. rcode 3 = NXDOMAIN (name does not exist), 2 = SERVFAIL, 5 = REFUSED
dns.qry.name contains "example.com" dns.time > 0.5 # slow answers (the response time)
dns.qry.type == 28 # AAAA (IPv6) queries 1 = A, 15 = MX, 16 = TXT, 5 = CNAME
HTTP
http.request http.response http.request.method == "POST"
http.response.code >= 400 http.response.code == 500 http.time > 1 # slow server responses
http.host == "example.com" http.request.uri contains "/api" http.user_agent contains "curl"
http.authorization # requests with credentials (cleartext HTTP only)
TLS (HTTPS)
tls.handshake.type == 1 # Client Hello 2 = Server Hello 11 = Certificate
tls.handshake.extensions_server_name == "example.com" # which site the client asked for (SNI)
tls.alert_message # TLS alerts (handshake failures, bad certificates)
tls.alert_message.desc == 40 # 40 handshake_failure 42 bad_certificate 48 unknown_ca 70 protocol_version 80 internal_error
tls.record.version == 0x0301 # very old TLS versions in use
tls.handshake.ciphersuite # ciphers offered or chosen
ICMP and IP
icmp icmp.type == 8 (echo request) icmp.type == 0 (echo reply)
icmp.type == 3 # destination unreachable: code 1 host, 3 port, 4 "fragmentation needed" (an MTU problem)
icmp.type == 11 # TTL expired (traceroute)
ip.flags.df == 1 ip.ttl < 10 ip.fragment
ARP and DHCP
arp arp.opcode == 1 (who-has) arp.opcode == 2 (is-at)
arp.duplicate-address-detected # two devices claim the same IP
dhcp dhcp.option.dhcp == 1 (Discover) 2 (Offer) 3 (Request) 5 (ACK) # some versions call this protocol "bootp"
Other
ssh smb2 || smb ftp.request.command == "PASS" smtp.req.command == "AUTH" kerberos ldap
ntp snmp syslog mdns || llmnr || nbns # local name lookups
frame.coloring_rule.name == "Bad TCP" # use the built-in coloring rule name
Wireshark's "expert" fields: _ws.expert _ws.expert.severity == error _ws.expert.severity == warning
Columns: make the packet list tell the story
Right-click a field in the details pane > Apply as Column. Useful columns to add:
tcp.stream tcp.len tcp.srcport / tcp.dstport frame.time_delta_displayed (time since the previous SHOWN packet)
ip.ttl dns.qry.name http.host http.request.uri tls.handshake.extensions_server_name _ws.col.protocol
Right-click a column header > Column Preferences / Resize to Contents / Hide.
Time format: View > Time Display Format:
Seconds Since Beginning of Capture (great for timelines) Seconds Since Previous Displayed Packet (great for spotting delays) UTC Date and Time of Day (to match logs)
Name resolution (View > Name Resolution): turn OFF network name resolution while capturing on a busy link. DNS lookups slow it down and can create traffic of their own.
Follow a conversation
Analyze > Follow > TCP Stream (Ctrl+Alt+Shift+T) Also UDP Stream, TLS Stream, HTTP Stream, HTTP/2 Stream, QUIC Stream
It rebuilds the whole exchange as readable text: red is client to server, blue is server to client. Choose "Show as: ASCII / Hex Dump / Raw" and use "Save as..." to keep it.
Use the "Stream" number box to step through streams. It applies a display filter (tcp.stream eq N) to the main window: clear it with Ctrl+/ then the X on the filter bar.
Right-click a packet > Conversation Filter > TCP / IPv4 / Ethernet to keep only that pair of endpoints.
File > Export Objects > HTTP (or SMB, TFTP, IMF) saves files and pages that crossed the wire in cleartext.
Statistics and analysis tools
Statistics > Capture File Properties Duration, packet count, average rate, and comments
Statistics > Protocol Hierarchy What share of the traffic each protocol makes up. Odd protocols stand out immediately
Statistics > Conversations Every pair of hosts and ports, with bytes and duration. Sort by Bytes to find the top talkers (Endpoints: single hosts)
Statistics > I/O Graphs Traffic over time. Add lines with filters (tcp.analysis.retransmission) to see WHEN problems happen
Statistics > Flow Graph A ladder diagram of packets between two hosts. Great for showing handshakes and delays
Statistics > TCP Stream Graphs Time-sequence (tcptrace), throughput, round-trip time and window scaling for one connection
Statistics > HTTP > Requests / Packet Counter / Load Distribution Statistics > DNS Query and response summaries
Statistics > Packet Lengths Sizes: many tiny packets or lots at the MTU limit tell you something
Analyze > Expert Information Wireshark's own list of Errors, Warnings, Notes and Chats. Start here on an unfamiliar capture
Analyze > Decode As... Tell Wireshark to treat a port as a different protocol (for example TCP port 8443 as TLS)
Analyze > Display Filter Macros / Expressions Save and reuse filter snippets View > Coloring Rules Edit colors
Telephony > VoIP Calls / RTP Analyze SIP calls, jitter and packet loss
Wireless > WLAN Traffic Wi-Fi statistics (needs a monitor-mode capture)
Statistics > Resolved Addresses All the names Wireshark learned from the capture
Colors and profiles
Default colors (View > Coloring Rules shows the exact list): light purple TCP, light blue UDP, dark blue DNS, green HTTP, pink ICMP, and black with red text for TCP problems
(retransmissions, resets, bad checksums). Black-and-red rows in a busy capture deserve a look.
Profiles (Edit > Configuration Profiles) keep separate columns, filters and colors. Make one per job, for example "Troubleshooting" (with tcp.stream, delta time, retrans filters)
and "Web" (with http.host and URI columns). Switch quickly from the profile name in the status bar (bottom right).
Filter buttons: click "+" at the right end of the filter bar to save a display filter as a one-click button (for example "Retransmissions", "DNS errors", "TLS alerts").
Keyboard shortcuts (common; check Help > Keyboard Shortcuts in your version)
Ctrl+E Start or stop a capture Ctrl+K Capture options Ctrl+R Restart the capture Ctrl+O Open a file Ctrl+S Save
Ctrl+/ Jump to the display filter box Ctrl+F Find a packet (string, hex, regex, or display filter) Ctrl+G Go to packet number
Ctrl+Down / Ctrl+Up Next / previous packet Ctrl+Alt+Shift+T Follow TCP stream Ctrl+M Mark or unmark a packet
Ctrl+Shift+N / Ctrl+Shift+B Next / previous marked packet Ctrl+D Ignore a packet Ctrl+T Set a time reference (see relative times from here)
Ctrl+Plus / Ctrl+Minus Zoom in / out Right-click a packet Conversation Filter, Follow, Copy, Export Packet Dissections
Go > Next Packet in Conversation / Go To Linked Packet (request to response). Edit > Mark All Displayed, then File > Export Specified Packets to save just those.
File > Export Packet Dissections > As CSV / JSON / Plain text saves what you see.
tshark: the command-line analyzer
tshark -D # list capture interfaces (with their numbers)
sudo tshark -i eth0 # capture and print packets (Ctrl+C to stop) (in the wireshark group you can skip sudo)
tshark -i eth0 -n # no name resolution (faster)
tshark -i eth0 -f "port 443 and host 10.0.0.5" # a CAPTURE filter
tshark -i eth0 -Y "http.request" # a DISPLAY filter while capturing (live only shows what matches)
tshark -i eth0 -c 100 -w out.pcapng # capture 100 packets to a file
tshark -i eth0 -a duration:60 -w out.pcapng # stop after 60 seconds -a filesize:100000 (KB) -a packets:1000
tshark -i eth0 -b filesize:100000 -b files:10 -w ring.pcapng # ring buffer: 10 files of about 100 MB, oldest are overwritten
tshark -r capture.pcapng # read a file
tshark -r capture.pcapng -Y "tcp.analysis.retransmission" # apply a display filter to a file
tshark -r capture.pcapng -Y "ip.addr == 10.0.0.5" -w filtered.pcapng # save just the matches
tshark -r capture.pcapng -c 20 # the first 20 packets tshark -r capture.pcapng -V -Y "frame.number == 5" full details of one packet
tshark -r capture.pcapng -O http -Y "http" # show only the HTTP layer in detail
tshark -r capture.pcapng -x -Y "frame.number == 5" # with a hex dump
Pull out exactly the fields you need (great for scripts and spreadsheets):
tshark -r capture.pcapng -Y "dns.flags.response == 0" -T fields -e frame.time -e ip.src -e dns.qry.name
tshark -r capture.pcapng -T fields -e ip.src -e ip.dst -e tcp.dstport -E header=y -E separator=, > flows.csv # CSV with a header row
tshark -r capture.pcapng -T json -Y "http" > http.json # JSON (also -T ek, -T pdml)
Summaries (the -z options: statistics). Add -q to suppress the packet list:
tshark -r capture.pcapng -q -z io,phs # protocol hierarchy
tshark -r capture.pcapng -q -z conv,tcp # TCP conversations (also conv,ip conv,udp)
tshark -r capture.pcapng -q -z endpoints,ip # top endpoints
tshark -r capture.pcapng -q -z io,stat,1 # packets and bytes per second
tshark -r capture.pcapng -q -z http,tree # HTTP status code counts -z http_req,tree requests -z dns,tree DNS statistics
tshark -r capture.pcapng -q -z expert # the Expert Information summary
tshark -r capture.pcapng -q -z follow,tcp,ascii,0 # follow TCP stream 0 as text
tshark -r capture.pcapng --export-objects http,./exported # save files that crossed the wire over HTTP
Capture with decryption or extra settings: tshark -o tls.keylog_file:$HOME/sslkeys.log -r capture.pcapng -Y "http2" -O http2
Preferences from the command line: -o "tcp.calculate_timestamps:TRUE" List all preferences: tshark -G currentprefs Find a field name: tshark -G fields | grep -i "dns.qry"
Practical tshark one-liners
# The 10 most requested DNS names
tshark -r c.pcapng -Y "dns.flags.response == 0" -T fields -e dns.qry.name | sort | uniq -c | sort -rn | head
# Top talkers by bytes
tshark -r c.pcapng -q -z conv,ip | head -20
# All HTTP requests with host and URL
tshark -r c.pcapng -Y http.request -T fields -e ip.src -e http.host -e http.request.uri
# The TLS server names (SNI) that clients connected to
tshark -r c.pcapng -Y "tls.handshake.type == 1" -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c | sort -rn
# Count retransmissions per stream
tshark -r c.pcapng -Y tcp.analysis.retransmission -T fields -e tcp.stream | sort -n | uniq -c | sort -rn | head
# Slow DNS answers (over half a second)
tshark -r c.pcapng -Y "dns.time > 0.5" -T fields -e frame.time_relative -e dns.qry.name -e dns.time
# Watch failed DNS lookups live
sudo tshark -i any -n -Y "dns.flags.rcode != 0" -T fields -e frame.time -e ip.src -e dns.qry.name -e dns.flags.rcode
# Every host that sent a SYN to port 22 (possible scan or brute force)
tshark -r c.pcapng -Y "tcp.dstport == 22 && tcp.flags.syn == 1 && tcp.flags.ack == 0" -T fields -e ip.src | sort | uniq -c | sort -rn
# Extract the User-Agent strings seen
tshark -r c.pcapng -Y http.user_agent -T fields -e http.user_agent | sort | uniq -c | sort -rn
# Bandwidth per second as a quick chart of numbers
tshark -r c.pcapng -q -z io,stat,1
# Convert a tcpdump capture to CSV
tshark -r c.pcap -T fields -e frame.time_epoch -e ip.src -e ip.dst -e frame.len -E separator=, > c.csv
Capture files: cut, merge and convert
capinfos capture.pcapng # size, packet count, time span, data rate, interfaces
capinfos -T -c -u capture.pcapng # a compact table with packet count and duration
editcap -c 100000 big.pcapng part.pcapng # split into files of 100,000 packets each
editcap -i 60 big.pcapng minute.pcapng # split into 60-second files
editcap -A "2026-09-26 10:00:00" -B "2026-09-26 10:05:00" big.pcapng slice.pcapng # keep only a time window
editcap -r big.pcapng first100.pcapng 1-100 # keep packets 1 to 100 (without -r it DELETES those and keeps the rest)
editcap -F pcap in.pcapng out.pcap # convert formats (pcapng to classic pcap)
editcap -d in.pcapng out.pcapng # remove duplicate packets (from capturing on two interfaces)
mergecap -w all.pcapng a.pcapng b.pcapng # merge in time order mergecap -a append instead
Very large files make the GUI slow. Filter and save a smaller copy first (tshark -r big -Y "filter" -w small), or split with editcap.
Capture without the GUI, then analyze
sudo tcpdump -i eth0 -w /tmp/cap.pcap -s 0 not port 22 # on a server (see the tcpdump sheet) scp the file to your workstation
sudo dumpcap -i eth0 -w /tmp/cap.pcapng -b duration:3600 -b files:24 # hourly files, keep 24 (needs the wireshark group or root)
Remote capture: stream a server's packets into your local Wireshark over SSH:
ssh user@server 'sudo tcpdump -U -s0 -i eth0 -w - not port 22' | wireshark -k -i -
"not port 22" is important: otherwise the SSH session capturing itself creates a feedback loop.
Or use Wireshark's built-in "SSH remote capture" (sshdump) in the interface list.
On a switched network you only see traffic to and from the capturing machine, plus broadcast and multicast. To see other hosts, capture ON the gateway or server, or use a
SPAN/mirror port or a network tap.
On Wi-Fi you must use monitor mode to see other stations' frames: it needs a compatible adapter, and encrypted traffic stays unreadable without the network key.
Decrypting HTTPS (TLS) in your OWN traffic
Modern TLS cannot be decrypted with the server's private key (forward secrecy). Instead, have the client write out its session secrets:
export SSLKEYLOGFILE=$HOME/sslkeys.log # in a terminal, then start Firefox or Chrome from that same terminal (curl 7.58+ also honors it)
firefox & # or google-chrome &
Wireshark: Edit > Preferences > Protocols > TLS > "(Pre)-Master-Secret log filename" > select the file. Then Follow TLS Stream, and http or http2 filters work on decrypted data.
tshark: -o tls.keylog_file:$HOME/sslkeys.log
Also useful without decryption: the TLS handshake shows the server name (SNI), TLS version, ciphers, certificate details (tls.handshake.type == 11) and alerts.
Only decrypt traffic from your own devices or with explicit permission. The key log file gives access to everything in those sessions: protect and delete it.
QUIC/HTTP3 uses the same key log approach (filter: quic or http3).
Analysis recipes: what to look for
Website or app is slow
1. Filter by the host: ip.addr == SERVER 2. Statistics > I/O Graph with tcp.analysis.flags 3. Compare tcp.analysis.initial_rtt (network) with http.time (server)
High round-trip time = network path. Fast handshake but slow http.time = a slow server or database. Many retransmissions = loss or congestion
Connection fails or hangs
SYN sent, no SYN-ACK, SYN repeated A firewall silently DROPS it, or the host is down or a route is wrong
SYN then RST (or RST,ACK) Nothing is listening on that port, or a firewall REJECTS it
Handshake completes, then a long silence The application is not answering. Check the server
RST in the middle of a session A firewall, load balancer or the server closed it abruptly. Look at who sent the RST and at what time
Connection works for small requests but stalls for big ones MTU/MSS trouble: look for icmp.type == 3 with code 4, and packets with DF set that vanish
DNS problems
Query with no response The resolver is unreachable or blocked (UDP 53 or 853)
NXDOMAIN (rcode 3) The name does not exist (typo, or a missing record)
SERVFAIL (rcode 2) The resolver failed (DNSSEC, upstream, lame server)
Long dns.time Slow resolver or retries to a dead server first (look for repeated queries to different servers)
TLS problems
tls.alert_message with description 40, 42, 48 or 70 handshake failure, bad certificate, unknown CA, wrong protocol version
Client Hello with no Server Hello The server or a middlebox blocked or dropped it
Very old version (tls.record.version 0x0301/0x0302) Legacy clients that modern servers will refuse
Network health and noise
Statistics > Conversations, sort by bytes Who is using the bandwidth?
Many ARP requests for one address, or arp.duplicate-address-detected IP conflict or a device that is down
Broadcast or multicast storms (eth.dst == ff:ff:ff:ff:ff:ff) A loop, or a chatty device
Lots of tcp.analysis.zero_window from one host That host is overloaded or its application is slow to read
DHCP problems: look for Discover with no Offer (no server reachable), Offer with no Request, or NAK responses (dhcp.option.dhcp == 6).
Security checks (on your own network, with authorization)
Many SYNs from one IP to many ports (a scan) tcp.flags.syn == 1 && tcp.flags.ack == 0 then Statistics > Conversations
Cleartext credentials (FTP, Telnet, HTTP Basic, SMTP AUTH) ftp.request.command == "PASS" || http.authorization || telnet these should all be replaced with encrypted protocols
Unexpected outbound connections or DNS to unfamiliar names Statistics > Endpoints, and the DNS name list above
Wireshark, tshark and tcpdump: which to use
tcpdump Quick captures and filters on servers over SSH. Available almost everywhere. Minimal decoding
tshark Scriptable, uses Wireshark's decoders and filters, great for summaries and field extraction on the command line
Wireshark Deep inspection, graphs, stream reconstruction, and following a story through a capture
dumpcap Long captures with ring buffers and low overhead
Typical workflow: capture with tcpdump or dumpcap on the server, copy the file, analyze it in Wireshark on your workstation.
Privacy and legal
- Capture only networks and traffic you own, or have written permission to inspect. Unauthorized capturing can be illegal
- Capture files can contain passwords, cookies, tokens, emails, personal data and internal hostnames. Treat them as confidential: restrict access, encrypt them, delete them when done
- Before sharing a capture with a vendor or a forum, remove or trim sensitive parts: filter to the relevant conversation, and consider anonymizing addresses (tools exist for this)
- Keep TLS key log files private and short-lived
- Do not run Wireshark as root all the time: use the wireshark group, and keep the software updated. Dissectors have had security bugs, so do not open captures from untrusted sources on a sensitive machine
Common problems
No interfaces are listed, or "You don't have permission to capture" Join the wireshark group (log out and in), or run with sudo. On Windows reinstall Npcap. On macOS install the ChmodBPF helper
Capture shows only my own machine's traffic A switched network only delivers your traffic. Use a SPAN/mirror port, a tap, or capture on the gateway or server
Wi-Fi capture shows nothing useful You need monitor mode and a compatible adapter, and encrypted frames stay unreadable without the key
Packets show "TCP Checksum Incorrect" for the local machine's own traffic Checksum offload: the NIC computes checksums after Wireshark sees the packet. Ignore it, or disable Preferences > Protocols > TCP/IP > "Validate checksum"
"Packets dropped by kernel" or a gap in sequence numbers The capture could not keep up. Use a capture filter, a shorter snaplen, dumpcap or tcpdump writing straight to a file, and a fast disk
Wireshark freezes on a big file Split with editcap, or filter first with tshark -Y ... -w. Turn off name resolution and colorization
I see "[TCP Previous segment not captured]" everywhere Either real loss, or the capture point missed packets (drops, or a mirror port that cannot keep up). Compare with a capture at the other end
HTTPS shows only encrypted data That is normal. Use the SSLKEYLOGFILE method for your own traffic, or analyze the handshake and timing instead
The display filter bar is red Syntax error. Use == for equality, quote strings, and use field names from the Display Filter Reference (right-click a field > Apply as Filter)
Filter works in the GUI but not in tshark -f -f takes a CAPTURE filter (BPF). Use -Y for a display filter
Live capture in tshark prints nothing with -Y The traffic does not match, or names are being resolved slowly. Add -n and test with a simpler filter
Time values look wrong View > Time Display Format. Captures store UTC timestamps
Decrypted HTTP2/HTTP3 does not appear The key log must include the session (start the client with SSLKEYLOGFILE set BEFORE it connects). Check Edit > Preferences > Protocols > TLS
Capture file will not open or "isn't a capture file" Truncated or another format. Try capinfos file, or open it in a newer version of Wireshark
Interface "any" shows odd headers Linux cooked capture (SLL) drops the Ethernet header. Capture on the specific interface for MAC-level details
Tips
Use a capture filter to keep files small on busy links, and a display filter for everything else.
Learn the two filter languages: host / port / net (capture) versus ip.addr / tcp.port / http.* (display). They are not interchangeable.
Start with Analyze > Expert Information and Statistics > Conversations to see what stands out before you scroll through packets.
Build filters by right-clicking fields (Apply as Filter), and add useful fields as columns and filter buttons.
Use Follow TCP Stream to read a whole exchange, and "Seconds Since Previous Displayed Packet" to find where the time goes.
Capture at both ends when you can. Comparing the two captures tells you where packets are lost or delayed.
On servers, capture with tcpdump or dumpcap to a file (excluding your own SSH port), then analyze it in Wireshark on your workstation.
Use tshark for repeatable summaries, CSV exports and one-liners. Save your favorite commands as shell functions.
Treat every capture as sensitive data: capture only with authorization, protect the files, and redact before sharing.
Wireshark's decoders and field names change between versions. Check Help > About, and the Display Filter Reference at wireshark.org/docs/dfref/ when a filter is not accepted.
