Wireshark for Beginners: Filters and What to Look For

Wireshark lets you see the individual packets crossing a network. For penetration testers it shows what a tool really sends; for SOC analysts it is how you prove what happened on the wire. It is free, and it is the best way to make networking theory concrete. Capture only on networks you own or are authorized to monitor.

Capture Filters vs Display Filters

A capture filter decides what Wireshark records in the first place, using the older BPF syntax, for example "host 192.168.56.101". A display filter hides packets from view after capture, using Wireshark's own syntax. Beginners should capture everything in a lab and use display filters to focus.

Display Filters You Will Use Constantly

• "ip.addr == 192.168.56.101": traffic to or from one host
• "tcp.port == 445": SMB traffic
• "dns": DNS queries and answers
• "http.request": HTTP requests only
• "tcp.flags.syn == 1 && tcp.flags.ack == 0": connection attempts, useful for spotting scans
• "!(arp || dns)": hide noisy background protocols

Follow a Conversation

Right-click a packet and choose Follow, then TCP Stream (or HTTP Stream), to read the whole conversation in order. For unencrypted protocols you will see requests, responses and sometimes credentials, which is exactly why those protocols should not be used.

Use the Statistics Menu

• Conversations: which hosts talked the most
• Protocol Hierarchy: what kinds of traffic are in the capture
• Endpoints: every address seen

These views turn a capture of thousands of packets into a short list of things worth examining.

What Scans and Attacks Look Like

• Port scans: many SYN packets from one host to many ports, mostly answered with resets
• ARP spoofing: one hardware address claiming several IP addresses
• DNS tunneling: long, random-looking subdomains in many queries
• Beaconing: a host contacting the same external address at regular intervals

HTTPS and Encryption

Most traffic is encrypted today, so you will see that a connection happened, to which server name, and how much data moved, but not the content. That metadata is still valuable in an investigation.

A First Exercise

In your home lab, start a capture, run an Nmap scan from Kali against a lab machine, then stop and filter for the SYN packets. Compare a default scan with a version scan. Then read networking basics for cybersecurity with the capture open.

Wireshark in Our Courses

Wireshark is used in our network and Active Directory course to read the traffic of attacks, and in the SOC course for network evidence in investigations.