Wireshark Tutorial for Beginners | Network Scanning Made Easy

Summary

Anson Alexander presents an updated beginner’s guide to using Wireshark on Mac and Windows to capture and inspect network traffic. The tutorial focuses on narrowing large packet captures (PCAPs) to investigate connectivity problems, suspicious activity, or devices using network bandwidth.

Main workflow and features

• Install and capture: Wireshark is free for Mac and Windows. On Mac, installation may require an additional package. Choose an active network interface—usually Ethernet or Wi-Fi—to start capturing, then stop the capture when you have enough data. Wi-Fi packet capture can depend on the hardware and operating system.
• Understand packets and conversations: Each row represents a packet. Under Statistics → Conversations, Wireshark summarizes communications by protocol, including endpoints, packet and byte counts, and duration. Knowing your device’s IP address, your router’s address, or a device’s MAC address can help identify relevant traffic.
• Filter efficiently: Right-click an address or packet to apply filters or follow a conversation. For example, ip.addr == 192.168.1.220 shows packets to or from that address. The tutorial recommends starting with a specific troubleshooting or analysis question rather than inspecting everything indiscriminately.
• Inspect HTTP traffic: Filtering with http can reveal unencrypted requests. Select a packet and choose Follow → HTTP Stream to view the exchanged content, which may include a webpage and information submitted through it. This illustrates why credentials entered over an insecure connection can be exposed to someone able to observe that traffic.
• Customize the interface: The tutorial demonstrates creating reusable filter buttons, viewing or editing Coloring Rules, changing the layout to show a packet diagram, and adding a delta time column.
• Try useful filters:
  • Exclude less commonly examined protocols: !(arp or stp or lldp or cdp)
  • Show TCP connection starts (SYN): tcp.flags.syn == 1
  • Show packets Wireshark flags for analysis: tcp.analysis.flags
  • Show TCP resets: tcp.flags.reset == 1

Wireshark’s colors and analysis flags are clues for further investigation, not proof of malware. Retransmissions, resets, and other flagged events can have ordinary explanations.

Accuracy note: The tutorial’s discussion of secure traffic appears to confuse ports. It describes TCP port 80 as encrypted traffic, but port 80 is generally used for HTTP; HTTPS commonly uses port 443. Encrypted traffic normally cannot be read from packet contents without the required decryption keys and configuration.

Practice resource

The video recommends malware-traffic-analysis.net for downloadable PCAP exercises. The site provides investigation objectives and explanations, making it a structured way to practice analyzing traffic.

Main speakers or sources

• Anson Alexander — tutorial narrator and presenter.
• malware-traffic-analysis.net — recommended source of practice PCAPs and analysis exercises.