Wireshark in 2026: The Definitive Guide

—
Wireshark is one of the most important tools for understanding what is actually happening on a computer network.
A useful way to think about Wireshark is as a stethoscope for networks.
A doctor uses a stethoscope to observe what is happening inside the human body.
A network engineer uses Wireshark to observe packets moving between systems.
Wireshark can help answer questions such as:

• Did the client send the packet?

• Did the server respond?

• Did the TCP handshake complete?

• Is DNS responding correctly?

• Which device sent the TCP reset?

• Are packets being retransmitted?

• How long did the server take to respond?

• Which TLS version was negotiated?

• Is the application using TCP or QUIC?

• Is a firewall, proxy, NAT, or load balancer changing the traffic?

• Is a network problem occurring in one direction or both?

Wireshark began as Ethereal in 1998 and was renamed Wireshark in 2006.
Today, it is a free and open-source network protocol analyzer used for networking, troubleshooting, protocol development, education, and authorized security analysis.
Modern networks are increasingly encrypted and distributed across:

• Data centers

• Public clouds

• Private clouds

• VPNs

• SD-WAN

• Containers

• Kubernetes

• Overlay networks

• CDNs

• Remote users

• Zero Trust environments

Encryption changes what packet captures can reveal, but it does not remove the value of packet analysis.
Even when application data is encrypted, Wireshark can often provide valuable information about connectivity, packet timing, transport behavior, TLS negotiation, QUIC behavior, retransmissions, resets, and network paths.

—

Understanding Wireshark and Packet Analysis

What Is Wireshark?

Wireshark is an open-source network protocol analyzer.
It can:

• Capture live network traffic

• Open previously captured packet files

• Decode network protocols

• Apply capture filters

• Apply display filters

• Follow conversations and streams

• Analyze packet timing

• Display protocol statistics

• Analyze TCP behavior

• Inspect DNS

• Inspect HTTP when visible

• Analyze TLS handshakes

• Analyze QUIC and HTTP/3 traffic

• Analyze SIP and RTP

• Export packet information for further analysis

Wireshark commonly works with capture formats such as:

• pcap

• pcapng

Wireshark and TShark

Wireshark provides a graphical interface.
TShark provides command-line packet analysis using many of the same protocol dissectors.
For example:

tshark -r capture.pcapng

A simple display filter can also be applied:

tshark -r capture.pcapng -Y "dns"

TShark is useful for:

• Automation

• Remote systems

• Scripts

• Large-scale filtering

• Extracting specific fields

• Processing capture files without the GUI

What Is a Protocol Dissector?

Wireshark understands protocols through dissectors.
A dissector interprets packet fields and presents them in a readable structure.
For example, a packet may contain several layers.

Wireshark separates these layers so you can inspect each one.

A Brief Wireshark History

Wireshark has evolved over many years.
1998
Gerald Combs started the project as Ethereal.
2006
The project was renamed Wireshark.
Modern Wireshark
Wireshark continues to evolve with support for modern networking technologies and protocols.
These include areas such as:

• TLS

• QUIC

• HTTP/2

• HTTP/3

• VXLAN

• Geneve

• GTP

• IoT protocols

• Cloud and virtualized networking

Why Wireshark Is Still Important With Encryption

Modern traffic is heavily encrypted.
Common examples include:

• TLS 1.3

• HTTPS

• QUIC

• HTTP/3

• VPNs

• DNS over TLS

• DNS over HTTPS

This means you may not always be able to read application payloads.
However, encrypted traffic still contains useful observable characteristics.
Depending on the protocol and capture location, you may still analyze:

• Source and destination addresses

• TCP or UDP ports

• Connection establishment

• Packet direction

• Packet timing

• Packet size

• Retransmissions

• TCP resets

• TLS ClientHello information that remains visible

• TLS ServerHello

• TLS alerts

• QUIC packets

• Network-path behavior

—

Using Wireshark in Modern Networks

Wireshark becomes especially valuable when network architectures become complicated.

Traditional Network Troubleshooting

Consider:

A basic path might include:

• Client

• Access network

• Firewall

• Load balancer

• Server

A client-side capture may show:

Client → Server    SYN

Server → Client    SYN-ACK

Client → Server    ACK

This proves that the client observed a completed TCP handshake.
It does not prove that every intermediate device saw exactly the same packet flow.

TLS Troubleshooting

Wireshark can analyze TLS handshake messages.
Display:

tls.handshake

ClientHello:

tls.handshake.type == 1

ServerHello:

tls.handshake.type == 2

TLS alerts:

tls.alert_message

Useful TLS troubleshooting information can include:

• Supported versions

• Negotiated TLS version

• Cipher-suite information

• Key-share information

• ALPN

• Server name where visible

• TLS alerts

• Timing

QUIC and HTTP/3

Traditional HTTPS commonly uses TCP.
HTTP/3 uses QUIC over UDP.
Filter QUIC:

quic

Filter HTTP/3 when Wireshark can dissect it:

http3

Check UDP 443:

udp.port == 443

A website working over TCP 443 does not prove that UDP 443 is working.
For HTTP/3 problems, investigate the complete UDP path.

Overlay Networks

Modern data centers and cloud environments frequently use encapsulation.
Examples include:

• VXLAN

• Geneve

• GRE

Wireshark can help inspect both outer and inner packet information when the capture contains the necessary encapsulated traffic.
This is useful when troubleshooting:

• Virtual networks

• Overlay routing

• Tunnel endpoints

• Encapsulation

• Inner application traffic

Cloud Packet Captures

Cloud environments can provide traffic-mirroring mechanisms that send copies of traffic toward packet-analysis systems.
Wireshark can then analyze the resulting capture.
The exact method depends on the cloud platform and network architecture.

IoT Analysis

Wireshark includes support for many protocols found in IoT and embedded environments.
Examples may include:

• MQTT

• CoAP

• DNS

• TCP

• UDP

• TLS

Packet analysis can help verify:

• Connection establishment

• Broker communication

• Message timing

• DNS resolution

• TLS behavior

• Unexpected endpoints

Mobile and Telecom Networks

Wireshark also supports protocols used in telecom and mobile network environments.
For example, GTP-related traffic can be inspected where the capture and dissector support the relevant protocol.
The exact visibility depends on:

• Capture location

• Encapsulation

• Encryption

• Protocol version

• Network architecture

—

Practical Wireshark Workflow and Essential Tools

A structured workflow is much more effective than opening a packet capture and searching randomly.

Step 1 — Define the Problem

Start with a specific question.
Bad question:

Better question:

The second statement gives you:

• Client

• Server

• Protocol

• Port

• Symptom

• Timing

Step 2 — Select the Capture Point

Possible capture locations include:

• Client

• Server

• Firewall

• Proxy

• Load balancer

• Router

• Cloud mirror

• Virtual switch

Choose the point that can answer your troubleshooting question.

Step 3 — Apply a Capture Filter When Appropriate

Example:

host 203.0.113.10

HTTPS over TCP:

host 203.0.113.10 and tcp port 443

DNS:

port 53

Step 4 — Reproduce the Problem

Record:

• Exact time

• Client address

• Destination

• Application

• Expected behavior

• Actual behavior

This makes correlation much easier.

Step 5 — Apply Display Filters

One host:

ip.addr == 192.168.10.25

One server:

ip.addr == 203.0.113.10

TCP 443:

tcp.port == 443

DNS:

dns

TCP retransmission indications:

tcp.analysis.retransmission

TCP resets:

tcp.flags.reset == 1

TLS:

tls

QUIC:

quic

Step 6 — Follow One Conversation

For TCP:

tcp.stream == 7

Replace 7 with the stream number from your capture.
Following one conversation removes a large amount of unrelated traffic.

Step 7 — Examine Timing

Look for:

• Delay before connection establishment

• Delay after TCP establishment

• DNS response time

• Retransmission timing

• TLS handshake timing

• Application response timing

Do not assume that every delay is network latency.
A delay can occur at several layers.

Step 8 — Compare Multiple Capture Points

For difficult cases, capture at both ends.

TLS Session Key Logging

In an authorized environment, some applications and TLS libraries can export session secrets.
Linux/macOS example:

export SSLKEYLOGFILE="$HOME/sslkeys.log"

Windows PowerShell:

$env:SSLKEYLOGFILE="$env:USERPROFILEsslkeys.log"

Configure Wireshark under:
Edit → Preferences → Protocols → TLS
Select the appropriate key-log file.
This may allow supported TLS sessions to be decrypted.
The same general technique can also help with supported QUIC traffic when the application exports the necessary secrets.

Long-Term Captures

Wireshark’s GUI is not always the best method for capturing continuously.
Command-line tools can create rotating packet files.
Example with tcpdump:

sudo tcpdump -ni any -G 300 -W 12 -w 'capture-%Y%m%d-%H%M%S.pcap'

This creates rotating files instead of allowing one capture file to grow indefinitely.

—

Real-World Troubleshooting and Security Use Cases

Use Case 1 — Slow Application

Suppose users report that a CRM application is slow.
Start with the affected client and server:

ip.addr == 192.168.10.25 && ip.addr == 203.0.113.10

Check TCP retransmission indications:

ip.addr == 192.168.10.25 && ip.addr == 203.0.113.10 && tcp.analysis.retransmission

Check resets:

ip.addr == 192.168.10.25 && ip.addr == 203.0.113.10 && tcp.flags.reset == 1

Then examine timing.

This is more useful than simply saying:
“The network is slow.”

Use Case 2 — TCP Retransmissions

Filter:

tcp.analysis.retransmission

Retransmission indications may support investigation of:

• Packet loss

• Delay

• Reordering

• Capture loss

• Congestion

• Path problems

Use Case 3 — DNS Failure

Filter:

dns

NXDOMAIN:

dns.flags.rcode == 3

SERVFAIL:

dns.flags.rcode == 2

One domain:

dns.qry.name == "sanchitgurukul.com"

Check:

• Query leaves client

• Resolver receives query

• Resolver responds

• Client receives response

• RCODE

• Timing

• Answer records

Use Case 4 — VoIP Problem

Start with SIP:

sip

Then inspect RTP when correctly decoded:

rtp

Wireshark provides RTP analysis features that can help investigate:

• Sequence behavior

• Packet loss

• Timing

• Jitter

• Stream direction

Use Case 5 — MTU Investigation

Packet captures can help investigate possible MTU or fragmentation problems.
Look for evidence such as:

• Fragmentation

• ICMP messages

• Repeated traffic

• Large packet behavior

• Different behavior between small and large transfers

• VPN or tunnel overhead

Do not diagnose an MTU problem from TCP retransmissions alone.

Use Case 6 — Authorized Security Investigation

Suppose security monitoring identifies suspicious outbound communication.
Packet analysis can help answer:

• Which host initiated the connection?

• Which destination was contacted?

• Which protocol was used?

• How frequently did communication occur?

• How much data was exchanged?

• Was application content visible?

• Did the communication use TLS?

• Did DNS resolution occur before the connection?

Use Case 7 — Firewall or Load-Balancer Troubleshooting

Capture before and after the device when possible.
Compare:

• Source IP

• Destination IP

• Source port

• Destination port

• TCP flags

• Sequence numbers

• Acknowledgment numbers

• MSS

• Timing

• Resets

—

Benefits, Limitations and Best Practices

Major Benefits of Wireshark

Deep Packet Analysis
Wireshark allows engineers to inspect protocol behavior packet by packet.
Protocol Learning
Protocols such as TCP and DNS become easier to understand when you can see their actual messages.
Vendor-Neutral Analysis
Packet formats are based on network protocols rather than a single vendor’s management interface.
Powerful Filtering
Display filters make large captures easier to investigate.
Offline Analysis
Capture files can be saved and reviewed later.
Command-Line Support
TShark supports automation and text-based analysis.

Important Limitations

Encryption
Protected application data may not be readable without authorized session secrets or other supported decryption information.
Capture Location
Wireshark only sees packets available at the observation point.
Large Capture Files
Large captures can consume significant disk space and memory.
Not a Complete Monitoring Platform
Wireshark is excellent for detailed packet analysis but is not a replacement for:

• SNMP

• Streaming telemetry

• NetFlow

• IPFIX

• SIEM

• Application monitoring

• Infrastructure monitoring

Wireshark vs Other Network Tools

Capture With Authorization

Only capture traffic when you have permission.
Packet captures may expose:

• Internal IP addresses

• DNS queries

• Hostnames

• User information

• Unencrypted credentials

• Application data

• Network architecture

• Authentication information

• Session information

Use Narrow Capture Filters

When you know the affected host:

host 203.0.113.10

This reduces unnecessary data.

Use Ring Buffers for Long Captures

Do not allow one capture file to consume all available disk space.
Use file rotation and storage limits.

Synchronize Time

Accurate timestamps are extremely important when comparing:

• Client captures

• Firewall captures

• Server captures

• Application logs

• Proxy logs

• Load-balancer logs

Use appropriate time synchronization such as NTP or PTP according to your environment.

Save as pcapng When Appropriate

pcapng supports useful modern capture-file features such as richer metadata and comments.

Protect Capture Files

Treat production captures as sensitive diagnostic data.
Do not upload them to public services without reviewing and sanitizing the contents.

Do Not Diagnose From One Packet

One packet rarely tells the entire story.
Always inspect:

• Previous packets

• Following packets

• Both directions

• Timing

• Related streams

• Other capture points

A Better Packet Analysis Method

Use this order:

1. Define the problem.
2. Identify client and server.
3. Record the test time.
4. Select the correct capture point.
5. Reproduce the problem.
6. Filter the affected traffic.
7. Identify the conversation.
8. Check connection establishment.
9. Check both packet directions.
10. Examine timing.
11. Check retransmissions and resets.
12. Inspect the next protocol layer.
13. Compare multiple capture points when required.
14. Correlate with device and application logs.

—

Summary

Wireshark remains one of the most valuable tools for understanding network behavior.
It can help analyze:

• Ethernet

• IPv4 and IPv6

• TCP

• UDP

• DNS

• HTTP

• TLS

• QUIC

• HTTP/3

• SIP

• RTP

• Overlay protocols

• Many other networking technologies

Its real value is not simply capturing packets.
Its value comes from using packets to answer specific technical questions.
For example:
Did the TCP connection establish?
Inspect SYN, SYN-ACK, and ACK.
Did DNS succeed?
Inspect the query, response, RCODE, and timing.
Why did the TCP connection close?
Identify which endpoint sent the FIN or RST and what happened before it.
Is HTTP/3 being attempted?
Inspect QUIC and UDP 443 traffic.
Where is a packet disappearing?
Compare captures from multiple points in the network path.
Modern encryption means engineers cannot always inspect application payloads.
But packet captures still provide valuable information about:

• Connectivity

• Transport behavior

• Timing

• Packet loss symptoms

• Retransmissions

• Resets

• TLS negotiation

• QUIC behavior

• Network paths

Wireshark should therefore be used alongside other visibility technologies rather than as a replacement for them.

—

Useful Links and References

SanchitGurukul Static Resources

Related SanchitGurukul Articles

Official External References