wireshark tutorial sniff network traffic

If you aren't already doing so, run the application of interest. Wireshark is now capturing any data involving the specified IP address, whether as a source or as a destination. This will create a filter that passes only that traffic either originating from or going to the specified host. In the text field next to the 'Capture Filter' button, type host, substituting in the IP address you care about for the part. It is surprising just how much network traffic goes through the interface and we don't want to see all of it. We need to create a capture filter to prevent Wireshark from capturing all network traffic going through the interface we chose in Step 4. Don't risk it, especially not for a tutorial. IMPORTANT: TURN PROMISCUOUS MODE OFF! IF YOU'RE AT WORK, YOUR NETWORK ADMINISTRATOR MAY SEE YOU RUNNING IN PROMISCUOUS MODE AND SOMEBODY MAY DECIDE TO FIRE YOU FOR THAT. First, pick the interface (i.e., network interface card, or NIC) you want to investigate. From the Wireshark menubar, choose Capture → Options. For instance you might pick an HTTP communication between your machine and a remote host. You can pick whatever you like but pick something where you know the IP address of the remote host. I'll pretend I'm troubleshooting the SMTP communication and to do that I want to see what's happening between my app and the SMTP server. For this tutorial I'll take a look at an SMTP (e-mail) session initiated by an application I wrote. Think of some network application running on your machine you'd like to investigate. The installation is completely straightforward. But if you just want to try it out then this is for you. I'm going to show you how to do something useful with Wireshark in fifteen minutes, even if you've never used it before. If you've ever wanted the fastest possible introduction to the Wireshark network protocol analyzer, today is your lucky day.

This gentle introduction gets you up and running in fifteen minutes or less. Troubleshoot your networked applications using the Wireshark network protocol analyzer.

Wireshark tutorial sniff network traffic