Wireshark is a network protocol analyzer used to capture and inspect the binary data flowing across a network interface card. It translates raw bits into readable, structured information for troubleshooting, security analysis, traffic verification, and deeper understanding of how network communication works.
Wireshark Introduction
If you like learning new things and geeking out over small technical details, then Wireshark is a program for you. If you don't — well, why are you getting into the IT field? Because it's a lot of learning about technical details.
If I wanted to send you a message, I could do it with something as simple as this flashlight. I could take this flashlight and shine it on and off in some sort of repeated pattern that you could recognize and translate into some sort of message that I'm sending you. All we would need ahead of time is to understand what code we're going to use to transmit this message. As an example, it might be Morse code. Morse code is just a series of dots and dashes. A dot is just a single on and off, versus a dash is an extended period of on before it turns off. By those two signals, dots and dashes, we can represent different letters.
Computers operate very similarly. I can take a cable, usually made of copper wire, and connect two computers together and then send a signal across those two computers. I could do this by varying the voltage across the cable. I can turn the power off completely so there's zero volts going across it, and then that could represent just a zero. And then what I could do is I could turn the voltage on — maybe it's 5 volts, maybe it's 12 volts, maybe it's 24 volts, maybe it's 120 volts. Whatever the voltage is, we're just going to represent that by a one. So if I turn the power off it's going to be a zero; if I turn it on it's going to be a one. There's going to be some sort of timing involved in how I turn these zeros and ones on and off, and so in the end we can map out some sort of coded message that I'm sending across the wire. This coded message is going to be a series of zeros and ones.
Now let's see what that looks like when someone is trying to access maybe some sort of servers or another user on the network. Between those two there's going to be the series of ones and zeros that are going to be sent back and forth. Wireshark is designed to capture this information so we can analyze it.
This device right here has something called a network interface card on it — it's an interface that gives it access to a network. Same thing with these servers: they have some sort of network interface on them that gives them access to this network, and then they can communicate back and forth. So what we're going to do in Wireshark is we're going to specify an interface that we're going to capture the data from, and then we can go and further analyze it.
One of the views that Wireshark gives us is the view of the actual bits that are flowing across that network interface card. Of course, this is not really useful, because what do all of these bits mean? If we were communicating through a flashlight, then we would have a set of rules agreed upon for how we were going to do that communication, and it would probably be something like Morse code. The same thing is true for a computer: there has to be some sort of format so that way, when this data is being sent from one device to another, there's an understanding of what these bits mean. Certain bits within here are going to have different meanings, so that way this device can interpret what the meaning of those bits are going to be.
What's great about Wireshark is it takes all of these bits of information and presents it in such a way that we can actually go in and understand and geek out over the information that's being passed across the network interface card.
So what would be the purpose of doing this? Number one, we could be doing it to analyze the traffic across our network for troubleshooting purposes. We may need to dig deeper into our network to figure out what's happening across it and figure out some sort of solution to an issue that we're having.
Another thing is from a security standpoint: the hackers will use Wireshark in order to analyze traffic coming across the network to be able to find out information and hack that network, perhaps capturing data like clear text passwords. But also from a security perspective — which I hope you're on this side of this — we can better understand what's happening on our network so we can secure it and make sure that it's locked down and not susceptible to these hackers.
Another thing is that we may need to just verify something. There are changes that we make on our network, and we may need to go in there and just do some verification of the traffic on there.
And finally, from a learning perspective, if you like learning you're going to love Wireshark, because we can start digging in and see what's happening. How is this traffic flowing, and how does it work? So I'm excited about showing you Wireshark so we can capture some data and start digging in and figuring out what this communication looks like across our network.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →