Capture where the traffic exists
Begin with a question and a permitted test: for example, does this lab client receive a DNS reply? Select its active interface and start before generating one request. Stop promptly, save the capture, and record the interface, time zone, filter, and reported drops. Analyse a copy if the capture must be preserved as evidence.
Promiscuous mode accepts traffic that reaches an interface; it does not force a switch to send all other hosts’ unicast traffic there. Endpoint captures, configured mirror ports, and network taps provide different views. Wireless monitor-mode capture also depends on adapter support and channel selection; an ordinary connected Wi-Fi interface does not show every nearby radio frame.
Read the three panes
Wireshark’s packet list summarises each recorded packet. Selecting a row exposes decoded protocol fields in the details pane and the corresponding raw bytes in the bytes pane. Work from the outer link header toward the application and record both directions, not just the first interesting row.
Start with a broad overview of protocols and endpoints, then narrow to one conversation. Follow TCP Stream can help read a connection’s data, subject to encryption and missing packets. Expert Information highlights conditions worth inspecting; its labels need context and are not an automatic diagnosis. Command-line tools such as tcpdump and TShark offer alternative capture and inspection workflows.
Filter the view deliberately
Capture filters select traffic before it is recorded, while display filters select from packets already in the file. A display filter can be cleared; traffic excluded from recording cannot be recovered from that file. The two filter languages are different. Capture expression host 192.0.2.10 and display expression ip.addr == 192.0.2.10 are not interchangeable.
For display practice, try dns, then tcp, then ip.addr == 192.0.2.10 && tcp.port == 80, applying each separately. Use tcp.stream == 0 only after checking the stream index in your file. Clear a narrow filter before concluding a prerequisite or reply is missing. The IPv4 address filter does not include ARP or IPv6.
Apply subnet knowledge to filter a whole network: ip.addr == 192.0.2.64/27 displays IPv4 traffic with a source or destination in that block. The capture-filter equivalent is net 192.0.2.64/27. These include addresses .64–.95, including the network and broadcast values; they do not select only assignable hosts.