Free tools Windows power users keep installed
One-click scans. No signup required.
Wireshark lets you inspect network traffic one packet at a time, either as it is captured or from a saved trace. To begin, open a capture or select the correct live network interface, then use the packet list, decoded details, and bytes panes to examine traffic. A display filter such as tcp can narrow what you see without deleting other packets from the file.
What Wireshark shows you
Wireshark is a graphical network protocol analyzer: it presents captured traffic as packets and decodes the protocols and fields it can recognize. Its display has three linked panes:
As an Amazon Associate I earn from qualifying purchases.
- Packet list: A summary row for each packet currently shown, including information such as time, endpoints, protocol, and a brief description.
- Packet details: The selected packet’s decoded protocol layers and fields. Expand a layer to inspect its contents.
- Packet bytes: The selected packet’s contents in hexadecimal, with corresponding text where available.
Selecting a row in the packet list updates the details and bytes panes. Start with the decoded fields; raw bytes are useful when you need to examine the underlying representation, but they can be harder to interpret.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Open a capture or choose a live interface
Learn from a saved trace
Opening an existing capture is a straightforward way to learn the interface without collecting traffic yourself. Wireshark can read common capture formats including pcapng and pcap. Open a trace, select a packet, and expand its protocol layers in the details pane.
#1 Best Overall
Capture live traffic
For a live capture, choose the network interface that carries the traffic you want to observe, then start capturing. A computer may have several interfaces, such as wired, wireless, or virtual adapters; choosing the wrong one can produce a trace that does not contain the traffic you expected. Live capture may also require capture privileges, depending on your operating system and setup.
Once the capture is running, generate or wait for the specific activity you are investigating, then stop the capture when you have enough traffic to examine. The resulting trace describes what Wireshark captured on that interface during that period—not every packet on the network or every possible cause of a problem.
Make your first investigation with a display filter
- Open or collect a trace. Use a saved capture or start a live capture on the appropriate interface.
- Enter
tcpin the display-filter bar. This simple protocol filter shows TCP packets in the current view. - Apply the filter. The packet list updates to show matching packets. Nonmatching packets are hidden from view, not removed from the capture file.
- Select a packet and expand its details. Inspect the decoded protocol layers and fields to see what the selected packet contains.
- Refine the question. Use a field you find in the packet details to focus the display further. If you do not know the field name or syntax, use Wireshark’s display-filter expression dialog or its field reference.
A filter helps answer a focused question—for example, “Which TCP packets are in this trace?” It does not by itself explain why a connection behaved a certain way. Interpret what you see in light of the capture’s interface, timing, and conditions.
Capture filters and display filters do different jobs
Both kinds of filter can limit traffic to a subset, but they act at different times and use different syntax. A capture filter uses libpcap filter syntax while traffic is being collected; a display filter uses Wireshark’s own language to decide what to show from traffic already captured.
| Filter type | When it acts | Effect on nonmatching packets | Syntax | Best suited to |
|---|---|---|---|---|
| Capture filter | During capture | Limits which packets enter the capture | libpcap filter syntax | Constraining collection before or while capturing |
| Display filter | When viewing a capture | Hides nonmatching packets from the current display; they remain in the capture file | Wireshark display-filter language | Investigating or focusing on traffic already captured |
Do not assume a filter written for one type will work as the other. If you need to preserve a broad trace and investigate it in stages, use display filters. If you need to limit what is collected at capture time, use a capture filter and its separate syntax.
Inspect fields and build more specific filters
Once you select a packet, expand the decoded layers in the packet-details pane to inspect individual fields. Wireshark can use a selected field to help construct a display filter through options such as “Apply as Filter.” When the field name or expression is unfamiliar, the display-filter expression dialog can help you choose from available fields and operators.
The display-filter reference is extensive and versioned. For Wireshark 4.6.9, its reference lists over 328,000 fields in 3,000 protocols; the count is tied to that version and may change in later releases. The reference is useful when you need to look up a field rather than guess its spelling.
Recommended Free Tools
Save the trace and preserve its context
Save packet data when you need to revisit an investigation or share the captured evidence. Keep a note of the conditions under which the trace was collected, such as the interface and the period or activity observed. Those details help distinguish what the capture actually shows from what it cannot establish. A display filter changes the view, so it is not a substitute for retaining the underlying trace when you may need to examine other packets later.
Best Value
Where to learn more
Wireshark’s official learning materials include documentation, tutorials, classes, and information about its official training partner. SharkFest, described by the Wireshark Foundation as an educational conference, offers lecture and lab-based packet-analysis sessions. Course offerings and event dates can change, so check the current listings if you want instructor-led training. A publisher preview describes Wireshark Essentials as a book for beginners as well as experienced readers; it is optional, and the version-current official documentation remains the reference for current interface and filter behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
