Performing a Basic Packet Capture

Overview

A packet capture is the foundation of every Wireshark workflow. Before you can analyze traffic, you need to capture it. This lesson walks through the process of starting and stopping a capture, selecting the right interface, and reading the first results.

Selecting Your Interface

When you open Wireshark, the welcome screen shows you a list of available network interfaces. Each interface represents a network adapter on your machine — your wired Ethernet connection, your wireless adapter, a loopback interface, and any virtual adapters from your VM software. You need to select the interface that carries the traffic you want to capture.

If you are capturing traffic between your Kali VM and your Ubuntu target, select the interface connected to your lab network. You will see a live activity graph next to each interface — the one showing activity is almost always the one you want.

Starting and Stopping a Capture

Click the interface name to start the capture. Packets will immediately begin appearing in the top pane. Wireshark captures everything — ARP, DNS, ICMP, HTTP, encrypted traffic, broadcast traffic — all of it. Let it run for 30 to 60 seconds while you generate some traffic (ping your target, open a browser, run an Nmap scan) then click the red Stop button.

Reading Your First Results

After stopping, use Wireshark’s display filter bar to narrow down what you are looking at. Type icmp to see only ping traffic. Type dns to see DNS queries and responses. Type http to see unencrypted web traffic. The display filter does not delete packets — it just shows the ones that match.

Key Takeaways

The first few captures always look overwhelming. Hundreds or thousands of packets in seconds. The goal is not to read every packet — it is to learn how to filter down to the traffic that matters. That skill, more than any other, is what makes someone effective with Wireshark.

Part of the free Intro to Cyber course by Cover6 Solutions.