Installing Wireshark and capturing safely

Let us install Wireshark and make a first capture of your own traffic.

Installation

• Windows: download the installer from wireshark.org. It includes Npcap, the driver that allows packet capture. Accept the Npcap installation.
• macOS: download the disk image from wireshark.org. The installer offers a helper that grants capture permissions so you do not need to run Wireshark as an administrator.
• Linux: install from your distribution's packages, for example sudo apt install wireshark on Debian and Ubuntu. When asked, allow non root users to capture, then add your user to the wireshark group and log out and back in.

Running the whole Wireshark interface as root is discouraged. The capture component needs privileges; the analysis interface does not.

Choosing an interface

On the start screen, Wireshark lists network interfaces with a small sparkline showing traffic. Pick the one your traffic actually uses:

• Wi-Fi on most laptops.
• Ethernet when wired.
• Loopback for traffic between programs on the same machine, such as a local development server.
• VPN interfaces when traffic goes through a VPN.

If you choose the wrong interface, you will see nothing relevant, which is a very common beginner frustration.

Your first capture

1. Double click your active interface. Packets start scrolling.
2. In a browser, visit a simple site such as http://neverssl.com, which deliberately uses plain HTTP so you can see the content.
3. Click the red square to stop the capture.
4. Type http in the display filter bar and press Enter.

You should see the HTTP GET request your browser sent and the server's response. Right click the request and choose Follow, HTTP Stream to see the whole conversation as text.

Saving captures

Save captures with File, Save As in the pcapng format, which stores comments and interface details. Name files clearly, for example 2026-04-02-login-slow-client.pcapng. When sharing, use File, Export Specified Packets to save only the relevant traffic, reducing both size and the amount of sensitive data shared.

Keep captures manageable

Captures grow quickly. On busy networks, a few minutes can produce gigabytes. Start captures just before reproducing a problem and stop soon after. For longer captures, use a ring buffer in the capture options, which writes a series of files of fixed size and discards the oldest. We also use capture filters, covered in lesson 4, to record only what matters.

Capture a minute of your own browsing, then find the DNS queries your browser made using the display filter dns.