Learn computer networks, Wi-Fi, routers, IP addressing, network protocols, troubleshooting, and network security through practical guides and step-by-step explanations.
Learn how to capture network packets, filter traffic, inspect protocols, investigate connection problems, and practice network analysis in your own lab.
Wireshark is a free, open-source network protocol analyzer. It captures packets from supported network interfaces and displays their protocol details so you can investigate how devices communicate.
A packet capture is a recorded view of network traffic available to your capture interface. It does not automatically reveal every packet on a Wi-Fi network or decrypt encrypted communication.
Investigate DNS failures, retransmissions, and connection issues.
Understand DNS, TCP, UDP, ICMP, HTTP, and TLS.
Examine suspicious connections and unexpected traffic patterns.
Inspect packet timing, TCP behavior, and communication flows.
Observe network exchanges when an application behaves unexpectedly.
Practice packet analysis using sample captures and lab traffic.
Enter these expressions in the display-filter bar. Display filters change which captured packets are shown; they do not limit what was originally captured.
Find domain name lookup requests and responses.
dnsInspect TCP connections and communication.
tcpFind HTTP traffic when it is present and dissected.
httpIdentify encrypted TLS connections and handshake details.
tlsInspect ping requests and replies.
icmpFind DNS responses containing an error code.
dns.flags.rcode != 0Identify packets Wireshark marks as TCP retransmissions.
tcp.analysis.retransmissionReplace the sample address with an IP in your own lab.
ip.addr == 192.168.1.10Wireshark includes command-line utilities. Open PowerShell or a terminal where these programs are installed and available in PATH.
tshark --versiontshark -Dtshark -r sample.pcapngtshark -r sample.pcapng -Y "dns"tshark -r sample.pcapng -T fields -e frame.number -e ip.src -e ip.dst -e _ws.col.ProtocolReplace sample.pcapng with your capture filename. Interface names, permissions, and installation paths vary by operating system.
Work through these exercises in order. Each one builds a practical packet-analysis skill.
Goal: Recognize how normal network activity appears in a capture.
Goal: Identify DNS queries, response records, and returned addresses.
Goal: Understand how TCP connections are established and which endpoints communicate.
Goal: Collect evidence that may help diagnose loss or connection problems.
Select a packet and expand its protocol layers. Examine the Ethernet, IP, TCP or UDP, and application protocol fields that are available in that packet.
Right-click a TCP packet and select Follow → TCP Stream. This groups related stream data when Wireshark can reconstruct it. Encrypted TLS application data generally remains encrypted.
Explore Statistics → Protocol Hierarchy, Conversations, and Endpoints to understand which protocols and devices appear in your capture.
Practice without recording live traffic using the official Wireshark sample captures.
Browse sample captures →An unfamiliar IP address, encrypted connection, or unusual packet alone does not prove malware or compromise. Validate findings with additional evidence.
Start with DNS and TCP, learn to read packet details, and then investigate retransmissions and connection failures. Regular practice with known-good captures will build your network troubleshooting skills.
Continue Learning
Continue exploring related guides to build your understanding step by step.