What is Wireshark?

Overview

Wireshark is the world’s most widely used network protocol analyzer. It captures network traffic in real time and lets you inspect every packet — seeing exactly what data is moving across your network, where it came from, where it is going, and what protocol it is using.

For defenders, Wireshark is a diagnostic and forensic tool. When something goes wrong on the network — an unexpected connection, a suspected exfiltration, an anomalous spike in traffic — Wireshark lets you look at the raw evidence. For offensive practitioners, it provides insight into how protocols work at the packet level, which is essential for understanding what you are exploiting and why.

What Wireshark Shows You

When you open a capture in Wireshark, you see three panes. The top pane lists every packet with its timestamp, source, destination, protocol, and a summary. The middle pane shows the decoded structure of the selected packet — broken down layer by layer from the Ethernet frame to the application data. The bottom pane shows the raw bytes in hexadecimal and ASCII.

This three-level view is what makes Wireshark powerful. You can move between the human-readable summary and the raw bytes depending on what you need to see.

Key Takeaways

Wireshark does not modify traffic — it only observes it. You can use it on your own network at any time for learning and troubleshooting. To capture traffic on a network you do not own, you need explicit authorization. In this module, all captures are performed on your lab network where you have full permission to do so.

Part of the free Intro to Cyber course by Cover6 Solutions.