Wireshark for Beginners: How Packet Sniffing Works (And What Hackers Actually See)

Every time your phone opens a web page, syncs a background email, or sends a message, raw electrical and radio pulses travel through the air. In normal everyday use, your network card only looks at packets addressed specifically to its own MAC address and ignores everything else.

When a packet sniffer like Wireshark runs in promiscuous mode, it tells your network card to stop ignoring those other packets and capture every single frame flying across the segment.

In this guide, we break down what packet sniffing actually does, how to isolate traffic with practical Wireshark display filters, how to extract plaintext passwords from unencrypted sessions, and how modern encryption protects you.

1. How Wireshark Listens: Promiscuous Mode Explained

Under default operating system rules, network interface cards (NICs) use hardware filtering. If a frame has destination MAC AA:BB:CC:DD:EE:01 and your card is AA:BB:CC:DD:EE:02, the card drops it before your CPU ever notices.

When you launch Wireshark as an administrator or with packet capture capabilities (CAP_NET_RAW), Wireshark flips your NIC into promiscuous mode:

• On Wired Hubs or Switched Port Mirrors (SPAN): You see all packets copied to your physical port.
• On Open Public Wi-Fi: Because radio signals broadcast in every direction, an adapter running in monitor mode can capture all unencrypted 802.11 frames transmitted by devices around you.

# On Debian / Ubuntu systems
sudo apt update
sudo apt install -y wireshark tshark

# Grant capture rights to non-root users (recommended for security)
sudo dpkg-reconfigure wireshark-common
sudo usermod -aG wireshark $USER

2. The Interface: Reading the 3 Main Panes

When you start capturing on an active interface (like wlan0 or eth0), thousands of packets scroll past every minute. Wireshark splits this firehose into three distinct visual sections:

1. Packet List Pane (Top): Shows packet number, timestamp, source IP, destination IP, protocol (TCP, UDP, DNS, TLS), length, and high-level summary info.
2. Packet Details Pane (Middle): Collapsible breakdown of the OSI model layers for the selected packet (Frame → Ethernet II → IPv4 → TCP/UDP → Application Layer).
3. Packet Bytes Pane (Bottom): The raw hexadecimal dump and ASCII translation of the actual bits sent across the wire.

3. The Essential Display Filters You Must Memorize

Trying to find an issue without display filters is like looking for a needle in a digital haystack. You type display filters into the green bar at the top of Wireshark:

# Show only HTTP traffic (unencrypted web requests)
http

# Isolate traffic coming from or going to a specific target IP
ip.addr == 192.168.1.50

# Filter specifically by communication between two specific hosts
ip.src == 192.168.1.50 && ip.dst == 192.168.1.1

# Catch login submissions (HTTP POST requests)
http.request.method == "POST"

# Filter by standard web and secure web ports
tcp.port == 80 || tcp.port == 443

# Show all DNS name resolution queries
dns

4. Catching Plaintext: Following a TCP Stream

When a website or legacy service uses unencrypted protocols (HTTP on port 80, FTP on port 21, Telnet on port 23), every keystroke travels across the network in clear ASCII text.

In a test lab environment, if a client submits an HTTP login form, Wireshark captures the entire packet payload. Here is what a captured HTTP POST packet looks like inside Wireshark:

Hypertext Transfer Protocol
    POST /login.php HTTP/1.1\r\n
    Host: lab.local\r\n
    User-Agent: Mozilla/5.0 (X11; Linux x86_64)\r\n
    Content-Type: application/x-www-form-urlencoded\r\n
    Content-Length: 38\r\n
    \r\n
    [HTML Form URL Encoded: application/x-www-form-urlencoded]
        username=admin&password=SuperSecretPassword123!

5. What Happens When HTTPS (TLS 1.3) Is Used?

What happens when the same login happens over a modern HTTPS website?

When you filter by tls, you will see the initial TLS Handshake (Client Hello, Server Hello, Key Exchange). Once the handshake completes, all subsequent application data is encrypted with symmetric session keys.

Instead of seeing username=admin&password=..., Wireshark only displays:

Transport Layer Security
    TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol
        Opaque Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 1420
        Encrypted Application Data: 4a9f1c7d23e801b9ca55f042e18d6a33...

Anyone sniffing the packet sees pure cryptographic random noise. They can see that an IP connected to a server on port 443, but they cannot read the URL path, the session cookies, the POST parameters, or the passwords.

6. Sniffing From the Command Line with TShark

On headless Linux servers or lightweight cloud droplets where you don't have a graphical desktop installed, Wireshark includes a powerful command-line sibling called TShark.

You can inspect live traffic and extract specific fields directly into your terminal:

# Sniff 20 HTTP requests on eth0 and print IP, Host header, and URI
sudo tshark -i eth0 -c 20 -Y "http.request" -T fields -e ip.src -e http.host -e http.request.uri

# Capture live traffic into a PCAP file for later analysis
sudo tshark -i eth0 -w /tmp/capture.pcap

# Read and filter an existing capture file without root rights
tshark -r /tmp/capture.pcap -Y "dns"

7. The 3 Defensive Habits Every User Must Follow

Understanding how easy packet sniffing is on unencrypted networks makes defensive precautions obvious:

• Never enter credentials on plain HTTP pages: Look for the padlock. Modern browsers block HTTP logins by default, but internal local devices (like old home router admin pages or IoT cameras) still use plain HTTP.
• Use a trusted VPN on public networks: A VPN encapsulates your entire operating system traffic in an encrypted tunnel before it leaves your laptop, blinding anyone sniffing local coffee shop or airport Wi-Fi.
• Enable DNS over HTTPS (DoH): Even on HTTPS sites, traditional DNS lookups (asking which IP matches example.com) are sent in unencrypted UDP packets on port 53. Enabling DoH in your browser or operating system encrypts your DNS requests as well.

Wireshark is not a magic hacking tool; it is a microscope for the network. Once you understand how packets look in motion, securing your own systems becomes second nature.