Skip to main content
Back to module
Networking Fundamentals · Troubleshooting

Packet capture basics

Reading50mLesson 3 of 3 in this module

Capture your own traffic in Wireshark, filter it, and read the layers of a DNS query and a TCP handshake.

Why it matters

Every tool so far gives you a summary. A packet capture shows the actual frames on the wire, so you can see exactly what a device sent and what came back. Security engineers use captures to investigate suspicious traffic, network and cloud engineers use them to prove where a connection fails, and database administrators use them to debug slow or dropped client connections. Wireshark is the free, standard tool.

Before you capture: rules

Capture only traffic you are authorised to see: your own computer on your own network, or a lab you are allowed to use. On a work or school network, ask first; capturing other people's traffic can break the law and policy even if the tool makes it easy. Captures can also contain your own secrets (cookies, internal names), so store them carefully and delete them when done.

How a capture works

Your network adapter normally hands the operating system only the frames meant for it. A capture library (Npcap on Windows, libpcap on macOS/Linux) copies frames as they pass through the adapter. On switched wired networks you see your own traffic plus broadcasts; on Wi-Fi you normally see only your own traffic. Captures are saved as .pcapng files.

The command-line equivalent is tcpdump:

sudo tcpdump -i en0 -n port 53        # DNS on interface en0
sudo tcpdump -i eth0 -n -w out.pcap   # save to a file for Wireshark

The Wireshark window

  1. Packet list: one row per frame: number, time, source, destination, protocol, length, info.
  2. Packet details: the layers of the selected frame, one expandable line each: Frame, Ethernet II, Internet Protocol, TCP or UDP, then the application protocol. This is the OSI model made visible.
  3. Packet bytes: the raw hex.

Filters

There are two kinds:

  • Capture filters (BPF syntax, set before you start) decide what is recorded: port 53, host 192.168.1.1.
  • Display filters (set after) decide what is shown, and are far more flexible:
dns                          DNS only
ip.addr == 93.184.215.14     to or from one address
tcp.port == 443              HTTPS traffic
tcp.flags.syn == 1           connection attempts
tcp.analysis.retransmission  resent segments (a sign of loss)
http || dns                  combine with or
!(arp || mdns)               hide noise

The filter bar turns green when the syntax is valid.

Worked example: reading a DNS lookup

You capture while running nslookup example.com and filter on dns:

No.  Source         Destination    Protocol  Info
12   192.168.1.57   192.168.1.1    DNS       Standard query 0x3a1f A example.com
13   192.168.1.1    192.168.1.57   DNS       Standard query response 0x3a1f A example.com A 93.184.215.14

Expanding packet 12: Ethernet II shows your MAC and the router's MAC; IPv4 shows the two IP addresses and a TTL; UDP shows source port 58123 and destination port 53; DNS shows the transaction ID 0x3a1f and the question. Packet 13 has the same ID, which is how your computer matches the answer to the question.

Worked example: a TCP handshake

Filter tcp.port == 443 after opening a site:

21  192.168.1.57 -> 93.184.215.14  TCP  52814 -> 443 [SYN]
22  93.184.215.14 -> 192.168.1.57  TCP  443 -> 52814 [SYN, ACK]
23  192.168.1.57 -> 93.184.215.14  TCP  52814 -> 443 [ACK]
24  192.168.1.57 -> 93.184.215.14  TLSv1.3  Client Hello

The time between 21 and 22 is the network round trip. If you saw SYNs repeated with no SYN-ACK, a firewall or a dead server would be the suspect; a reply with [RST, ACK] means the host answered but nothing listens on that port.

Follow TCP Stream on an HTTPS connection shows unreadable bytes: TLS works. The Client Hello still shows the SNI (server name), which is why an observer can usually tell which site you visited.

Common mistakes

  • Capturing everything for an hour and drowning. Reproduce the problem, capture for seconds, then filter.
  • Confusing capture and display filter syntax (port 53 vs udp.port == 53).
  • Expecting to see other devices' Wi-Fi traffic. You normally see only your own.
  • Sharing a capture file without checking what personal data it holds.

Quick recap

  • Wireshark shows every frame with its layers decoded: Ethernet, IP, TCP/UDP, application.
  • Use display filters (dns, tcp.port == 443, tcp.flags.syn == 1) to find what matters.
  • A handshake, a reset or repeated SYNs tell you exactly where a connection fails.
  • Capture only what you are authorised to capture, and handle files as sensitive.

Next step if you enjoyed this course: CompTIA Network+ is a common vendor-neutral certification; see https://www.comptia.org/certifications/network for the current exam details (Checked on 2026-10-23).

Try it

Open the Do tab and capture and read your own DNS and HTTPS traffic.

Also in this lesson: