Wireshark is a free, open-source network protocol analyzer. Network administrators, cybersecurity professionals, and hobbyists use it to capture and inspect traffic on networks they own or are authorized to monitor. This guide covers installing it, capturing and filtering traffic, and reading what you capture. It also covers where the line sits between legitimate diagnostic use and identifying other people on a network without their consent.
TL;DR: Wireshark captures and decodes network packets in real time. It’s genuinely useful for troubleshooting your own connection, learning how protocols work, and authorized security investigations. It is not a legitimate way to identify other players in an online match. Using it, or any packet-capture tool, against traffic that isn’t yours without permission can violate platform rules and, depending on where you live, the law.
What Wireshark Actually Does
Wireshark captures packets as they cross a network interface, then decodes them according to their protocol. It shows headers, payloads, and timing in an organized, filterable view. It runs on Windows, macOS, and Linux, and covers a very wide range of protocols, from basic TCP/IP to HTTP, DNS, and beyond.
Key features:
- Real-Time Packet Capture: shows traffic as it happens on the interface you select.
- Protocol Analysis: decodes dozens of protocols with detailed, field-level breakdowns.
- Filtering: capture and display filters let you isolate exactly the traffic you’re diagnosing.
How to Use Wireshark
1. Launch Wireshark
- Open it from your applications menu, or type
wiresharkin a terminal. - Select the network interface you want to monitor: Ethernet, Wi-Fi, or another available interface.
2. Capture Traffic
- Click the interface to start capturing. Packets appear in real time in the Packet List pane.
- Use capture filters to limit what’s recorded. For example,
port 80captures HTTP traffic only.
3. Analyze What You Captured
- Click a packet to see details in the Packet Details and Packet Bytes panes.
- Use display filters to refine your view. For example,
ip.addr == 192.168.1.1isolates traffic from one address on your own network. - Right-click a packet and choose “Follow > TCP Stream” to see a full conversation.
4. Save and Export
- Save a capture via
File > Save As, typically as pcapng. - Extract embedded files via
File > Export Objects.
What Wireshark Is Legitimately Used For
Network troubleshooting: finding slow performance, connectivity issues, and packet loss on a network you administer.
Security analysis: spotting unusual traffic patterns or investigating an incident on infrastructure you’re responsible for.
Protocol development and learning: seeing how protocols actually behave. This is also why it’s widely used for teaching networking concepts.
Advantages and Disadvantages
| Advantages | Disadvantages |
|---|---|
| Open-source and free, regularly updated by a large community. | Steep learning curve for using every feature well. |
| Deep packet analysis, useful for troubleshooting and performance work. | Requires admin/root access to capture live traffic. |
| Wide protocol support across many network environments. | Local capture only, unless paired with a remote tap or port mirroring setup. |
| Live capture and offline analysis of saved files. | Can produce a lot of data without good filtering. |
| Extensible with custom filters and plugins. | Not an intrusion-detection or blocking tool on its own. |
Installing Wireshark on Ubuntu
1. Update your system
Open a terminal (Ctrl+Alt+T) and run:
sudo apt update
2. Install Wireshark
sudo apt install wireshark
Accept any prompts for additional dependencies.
3. Allow non-root capture
Run sudo usermod -aG wireshark $USER. Then log out and back in for the change to apply.
4. Verify
Run wireshark --version, then launch it from the terminal or applications menu.
5. Configure capture interfaces
Go to Edit > Preferences > Capture. Select and enable the interfaces you want to monitor, and confirm your account has the permissions it needs to capture.
Reading IP Addresses in a Capture
This is for understanding your own network, seeing which of your own devices is talking to what, not for identifying other people.
- Filter for IP traffic: use the display filter
ipto show packets containing IP addresses. - View packet details: click a packet, then look under the Internet Protocol section for the
SourceandDestinationfields. - Filter by a specific address:
ip.addr == x.x.x.xisolates traffic involving one address. This is useful for seeing what one of your own devices is doing.
Reading Colors in Wireshark
Wireshark color-codes packets by default so you can spot protocol types and problems quickly. Red commonly flags packets Wireshark considers problematic, things like retransmissions or errors worth reviewing. Color rules are fully customizable under View > Coloring Rules.
Wireshark vs Tcpdump
Wireshark has a graphical interface with deep protocol decoding, packet reassembly, and real-time visualization. It’s better suited to detailed, exploratory analysis. Tcpdump runs entirely from the command line with text output. It’s lighter weight and better suited to scripting, automation, and high-speed capture, cases where a GUI would just slow things down. Tshark, Wireshark’s command-line counterpart, sits in between: it’s Wireshark’s analysis engine, without the GUI.
Other Legitimate Alternatives
If Wireshark doesn’t fit your use case, see our full network traffic analysis tools comparison. It covers Tcpdump, Tshark, CommView for Wi-Fi, NetworkMiner, GlassWire, and where authorized security-testing tools like Ettercap fit in. OctoSniff specifically is a third-party, unofficial tool aimed at gaming traffic, with real download-safety and privacy concerns of its own. See our OctoSniff safety guide rather than treating it as a Wireshark substitute.
Where This Doesn’t Apply: Other Players’ Traffic
Wireshark and similar tools can technically capture packets from other devices on a shared network segment. But using that to identify another player in an online match, or anyone else’s traffic without their consent, is not a legitimate diagnostic use. It can breach the terms of service of whatever platform you’re playing on, and depending on your jurisdiction, intercepting someone else’s communications without authorization can carry legal risk too. If you suspect you’re being targeted by a DDoS attack, the useful response is restarting your router, contacting your ISP, and reporting the account through your platform, not trying to identify or retaliate against the source yourself. See our guide on protecting your own connection for the safe version of this.
Frequently Asked Questions
What is network traffic analysis?
Looking at the data moving across a network to understand what’s happening: finding problems, improving performance, and spotting security issues.
What is Wireshark used for?
Capturing and decoding network traffic in detail. It’s commonly used for troubleshooting, learning networking protocols, and authorized security investigations.
What are some alternatives to Wireshark?
Tcpdump and Tshark for command-line use, CommView for Wi-Fi for wireless-specific capture, and NetworkMiner or GlassWire for something simpler and passive. Full comparison in our alternatives guide.
Is OctoSniff a good alternative to Wireshark?
No. OctoSniff is an unofficial, third-party tool with real download-safety and privacy concerns of its own. See our OctoSniff safety guide before considering it.
How is Tcpdump different from Wireshark?
Tcpdump is a lightweight command-line tool for quick captures. Wireshark has a fuller graphical interface, better suited to detailed, exploratory analysis.
Can I use Wireshark to find another player’s IP address in a game?
It might technically show up in a capture on some older peer-to-peer titles, but using it that way isn’t a legitimate diagnostic use. It breaches most platforms’ terms of service, and can carry legal risk depending on your jurisdiction. Report suspected harassment or attacks through your platform instead.
Can Wireshark help if I suspect a DDoS attack?
It can show that your traffic pattern looks abnormal, which helps confirm something is happening, but it isn’t a defense on its own. Restart your router, contact your ISP, and report the account through your platform, rather than trying to identify or retaliate against the source yourself.
Bottom Line
Wireshark is a genuinely valuable, well-documented tool for understanding your own network and for authorized security work. Use it to diagnose your own connection, learn how protocols behave, or support a legitimate investigation. Don’t use it to identify or track other people on a network you don’t control.
