For a free, packet-level look at what your Windows PC sends and receives, use Wireshark. It is free, open source, and can capture traffic on the network interface your PC is actively using. What it shows is the traffic crossing that interface at that capture point. It does not, by itself, tell you whether a connection is malicious or whether the computer is compromised. The useful skill is knowing what to capture, how to read it, and when to stop there.
What a capture can and cannot tell you
A packet capture records individual packets: their source and destination addresses, ports, protocols, sizes, timing, and, for unencrypted traffic, their contents. That makes it a good tool for answering questions such as “Which remote address is this program talking to?” or “Is this PC making DNS lookups I can account for?” It is a poor tool for answering “Is this PC infected?” on its own. An unfamiliar address is a lead to follow, not a verdict. The official Wireshark User’s Guide describes Wireshark as a packet analyzer; the guide’s own wording, quoted below, is the clearest statement of what the tool is.
As an Amazon Associate I earn from qualifying purchases.
Wireshark describes itself in its User’s Guide in these terms:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute“Wireshark is available for free, is open source, and is one of the best packet analyzers available today.” Source: Wireshark User’s Guide.
#1 Best Overall
- (10/100/1G) Gigabit Bypass network tap / sniffer equivalent to port mirror on a switch.
- The two monitor/sniff ports are isolated from the network being monitored.
- Automatic bypass of device on power fail.
- Power-over-Ethernet (POE) pass-through. Rated at .75A max at 57vdc
- 5v power through USB3 port or 5v wall transformer (or both). ~500ma consumption.
Set the scope first: your own PC and networks you are allowed to monitor
Limit captures to your own device, or to a network where you have explicit authorization to monitor traffic. Wireshark’s official capture setup guide says to confirm permission before capturing. This matters because a capture on a shared network can include other people’s activity, even when you only meant to look at your own machine.
Local capture is the simplest starting scope. Seeing traffic between other devices is a different task, covered in the limits section below.
Windows prerequisites
Three things must line up before a capture shows anything. The official Windows FAQ states that capture depends on the operating system, the Npcap library and driver, and support from the network interface itself.
Rank #2
- The SharkTap is a special purpose 10/100/1000Base-T ethernet device that allows you to 'tap into' an ethernet connection. It is intended to be used with the free Wireshark protocol analyzer or equivalent.
- Conventional switches route packets only to the intended destination port, reducing traffic but preventing a third port from seeing all packets. The SharkTap duplicates all packets to or from the Network ports to the TAP port.
- Supports 10, 100 and 1000Base-T, all ports. Power-Over-Ethernet (PoE) pass-through.
- Powered from a USB-B cable (included), draws 350mA or less.
- Other features: Auto-MDIX, so no crossover cables ever needed. Non-conductive enclosure for lab work. Will NOT route packets from TAP to Network ports.
- Npcap. Wireshark on Windows uses Npcap to access the network. Keep the Npcap option selected during Wireshark’s installation unless you already have a current Npcap installed.
- Capture privileges. Your account needs permission to use the capture driver. If the interface list is empty or capture fails with a permissions error, reinstall Npcap with administrator rights and then reopen Wireshark as administrator.
- The correct interface. Your PC may have several adapters, including virtual ones. Capture on the adapter that carries your real traffic.
If a capture starts but shows no packets, treat that as a setup or visibility problem before you treat it as a sign of a clean machine. Check the interface, confirm Npcap is installed, and generate traffic again. An empty capture proves only that nothing crossed that interface during that window.
Capture your own traffic: step by step
- Install Wireshark from the official project and keep the Npcap component selected. Check the official setup documentation for the current installer options, since they can change between releases.
- Find your active connection. In Windows 11, open Settings > Network & internet and note whether you are on Wi-Fi or Ethernet. A laptop on Wi-Fi uses the Wi-Fi adapter; a desktop on a cable uses the Ethernet adapter.
- Open Wireshark and locate that interface in the start page list. Interfaces that show a moving activity line are carrying traffic at that moment.
- Start the capture by double-clicking the interface name.
- Generate ordinary traffic for one to two minutes: load a few web pages, open a mail client, or run an app that syncs. A short, known activity window makes the results easier to read.
- Stop the capture with the red square Stop button on the toolbar.
- Narrow the view. Type a display filter in the filter bar, such as
dnsto see name lookups,tcp.port == 443for HTTPS connections, orip.addr == 192.0.2.10to follow one address (replace the example address with one from your capture). Then open Statistics > Conversations to see which address pairs exchanged the most data. - Save the capture with File > Save As if you want to revisit it. Keep it private, as explained below.
The capture should show your own machine’s traffic as source and destination pairs, with protocol names in the packet list. If your browser is open and you see no HTTPS or DNS traffic while loading pages, check that you selected the right interface.
Reading what you see
Begin by building a baseline. Note the destinations your normal software contacts during a capture: name lookups, the update services of your browser, your cloud sync client. Once you know the routine traffic, an unfamiliar destination stands out for a reason you can check.
Rank #3
![Dualcomm10/100/1000Base-T Gigabit Ethernet Network TAP [ETAP-2003]](https://m.media-amazon.com/images/I/41BN4VAnktL._SL160_.jpg)
- Network Tap for use with 10/100/1000Base-T Ethernet link
- Reliable and high performance. Tested with maximum in-line cable length (200m) at full 1Gbps data throughput with no single packet loss
- Capable of being powered from a computer's USB port with built-in inrush current limiting circuit to prevent the computer from possible damages or disturbances by instantaneous current surge
- Compatible with Power-over-Ethernet (PoE)
- Probably the smallest portable GbE Network Tap available on the market
Correlate each unfamiliar connection with a process
A packet shows an address and a port, not the program that opened it. To link a connection to a program, list active connections with port-to-process mapping. In Command Prompt, run netstat -ano and note the process ID (PID) for the connection’s remote address and port. Then match the PID in Task Manager’s Details tab, or in PowerShell, run Get-NetTCPConnection and look at its OwningProcess value.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the destination, but do not stop there
Ask whether the destination is one your software is expected to contact, whether the process that opened it is one you recognize, and whether the timing matches something you did. A connection that fits none of those answers deserves more investigation, such as checking the program’s location on disk. It is still not proof of malware. Many legitimate services use changing addresses and content delivery networks.
Recognize what encryption hides
Most modern web traffic is encrypted. Wireshark can show that a session happened and reveal metadata such as addresses, ports, timing, and sizes. Encrypted payloads generally stay unreadable unless you have the session keys, so do not expect a capture to show the contents of an HTTPS page or app session.
Rank #4
- Ethernet Test Access Port that does not require an ethernet port, for thin notebook or netbook PCs. Uses USB 3 or USB 2 port on PC (Also provides a CAT-5 TAP port)
- A 'Test Access Port' allows you to see the packets on an ethernet link. Directly supports 10-, 100- or 1000Base-T links.
- Intended to be used with the open source Wireshark program, or equivalent.
- The Gen2 SharkTapUSB features 'carbon copy' copper repeater technology for minimum impact on the monitored network. The carbon copies of bi-directional data are aggregated onto a single wired or USB Test Access Port (TAP)
- Power-over-ethernet pass through. (For power-fail bypass, search "SharkTapBYP") 400mA current. Non-conductive plastic cover. Auto cross-over for cables. USB3 cable included
Limits of a local capture
Local capture is the easy scope, and it has boundaries. Wireshark’s capture setup guide recommends starting with traffic to and from the local machine because that is the easiest route to a successful capture. For traffic that is destined for other machines, the guide says to capture at a point in the network topology that the traffic actually passes through. Your PC’s interface will not see another device’s traffic just because both devices are on the same network.
Wireless capture is more restrictive. The official WLAN capture guidance says broader 802.11 visibility, meaning frames not addressed to your own PC, requires monitor mode and compatible hardware and driver support. On Windows, that depends on the adapter and driver. Many built-in adapters cannot do it, so the absence of such frames in your capture is not evidence that they do not exist.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| Scope | What you can see | Setup and hardware requirements |
|---|---|---|
| Your PC, active interface (this guide) | Traffic sent to and from your PC, as shown by the official capture setup guide | Wireshark with Npcap, capture privileges, correct interface. The official sources do not establish any extra hardware as necessary. |
| Other devices on the same network | Only traffic that passes through the capture point you choose | Capture placed where the traffic passes. Placement method not stated in the official capture setup guide beyond this principle. |
| Wi-Fi frames beyond your own PC | Depends on monitor-mode capture support | Monitor mode plus compatible hardware and driver on Windows, per the official WLAN guidance. Specific adapter models not stated. |
Keep capture files private
A packet capture can reveal a great deal about a person’s online activity, including which services they use and when. Store capture files in a folder you control, avoid sharing them publicly, and delete them when you no longer need them. This is sound practice rather than a rule set by the official documentation.
Best Value
- First-of-Its-Kind "One Size Fits All" Network TAP: Supports both copper and fiber Ethernet links, with speeds ranging from 100Mb/s to 10Gb/s (100M/1G/2.5G/5G/10G).
- Patented High-Gigabit Signal Duplication Technology: eliminates the need for 10G+ fanout buffer IC chips, significantly enhancing reliability while minimizing power consumption.
- Versatile Connectivity: Features two inline network ports and two monitor ports with SFP+/SFP slots, compatible with copper and fiber transceivers for data rates from 100Mb/s to 10Gb/s.
- Simplified Fiber TAP Operation: Eliminates the need to specify an optical split ratio, streamlining setup and usage.
- Real-Time Performance: Guarantees zero transmission delays, ensuring accurate data monitoring and analysis.
What this costs
The basic workflow described here uses free software: Wireshark and Npcap, both from the official project, plus built-in Windows tools such as Settings, Task Manager, Command Prompt, and PowerShell. Nothing in the official documentation makes a physical product necessary for inspecting your own PC. Monitor-mode adapters and network capture points belong to a broader scenario, one in which you monitor other devices or wireless frames, and they are a separate decision.
For more detail on capture options, consult the official capture setup guide, the Wireshark FAQ, and the WLAN capture guidance. The User’s Guide matching your installed version is the most reliable reference for menu names and options, since they can change between releases; the Wireshark User’s Guide PDF for version 4.7.0 is one published version of that reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
