Diagnosing Problems · Topic 2 of 6
Packet Capture with Wireshark
Learn what a packet analyzer does, how to capture traffic with Wireshark, use simple display filters, and save and reopen a .pcap or .pcapng file.
- 4 min
- A packet analyzer records and displays the packets on a network connection.
- Wireshark is a common packet analyzer.
- You choose an interface, start the capture, reproduce the problem, then stop and save.
What it is
A packet analyzer is a tool that records the packets crossing a network connection and lets you read them.
Wireshark is a popular free packet analyzer. It shows each packet with its addresses, protocol and contents, so you can see exactly what devices are saying to each other.
Technicians use it when simple tools are not enough. It can show whether a request was sent, whether an answer came back, and what went wrong in between.
How it works
You pick an interface, start the capture, reproduce the problem, stop, and then read and save the result.
Why use a packet analyzer
A packet capture helps in several cases.
- To check whether a device sends or receives the expected traffic.
- To find the cause of slow or failing connections.
- To see which protocols and addresses are in use.
- To keep evidence for another technician or for security work.
Capturing packets
The basic steps are as follows.
- Open Wireshark and choose the network interface that carries the traffic, such as your Ethernet or Wi-Fi adapter.
- Start the capture. The toolbar has a button for this.
- Reproduce the problem, for example by loading a web page.
- Stop the capture when you have enough.
On a switched network, a PC normally sees only its own traffic, broadcasts and some multicast. To see another device's traffic you need to capture at a place where it passes, or have the switch copy that traffic to your port.
Reading the screen
The main window has three panes.
| Pane | Shows |
|---|---|
| Packet list | One line for each packet, with time, source, destination, protocol and a short summary |
| Packet details | The selected packet, split into layers such as Ethernet, IP and TCP |
| Packet bytes | The raw data of the packet in hexadecimal |
Busy networks produce thousands of packets, so you narrow the view with a display filter. The filter hides packets without deleting them.
| Filter | Shows |
|---|---|
dns | DNS traffic |
icmp | Ping and other ICMP messages |
tcp.port == 80 | TCP traffic on port 80 |
ip.addr == 192.168.1.10 | Packets to or from that address |
A capture filter is different. It is set before the capture and limits what is recorded at all.
Saving and opening a capture
Use the File menu to save the packets to a file. Wireshark can save in pcapng, its newer default format, or in the older pcap format, which is the classic .pcap file. Other tools can read pcap files, so this format is handy for sharing.
To look at a saved capture, use the File menu and choose Open, then pick the file. The packets appear as if you had just captured them, and you can apply filters again.
capture1.pcapGive the file a clear name, and note the date and the problem it relates to.
Privacy and permission
A capture can contain passwords, messages and personal data, especially from protocols that do not encrypt. Only capture on networks you are allowed to monitor, and store the files safely.
What to remember for the exam
Six facts cover most questions on this topic.
- A packet analyzer records and displays the packets on a network connection.
- Wireshark is a common packet analyzer.
- You choose an interface, start the capture, reproduce the problem, then stop and save.
- A display filter narrows what you see. A capture filter limits what is recorded.
- Captures are saved as
.pcapor.pcapngfiles, and can be opened again later. - A capture can hold sensitive data, so capture only where you are permitted to.
To check a name lookup problem, capture while you try the lookup and filter on dns.
Common mistakes
These four errors appear again and again.
Capturing on the wrong interface. If no useful packets appear, check that you chose the adapter in use.
Forgetting to save. A capture that is not saved is lost when you close the program.
Expecting to see all traffic on a switch. A PC sees mostly its own traffic.
Sharing a capture without thinking. It may hold passwords or private information.
Do not capture traffic on a network you have no permission to monitor. It may break the rules of the organisation or the law.
Check yourself
Work through these three questions.
What is the purpose of a packet analyzer?
It records and shows the packets on a network, so you can see what devices send and receive.
What is the difference between a display filter and a capture filter?
A display filter hides packets from the view. A capture filter limits which packets are recorded at all.
In which file types can a capture be saved?
It can be saved as a
.pcapfile or as a.pcapngfile.
Topic 2 of 6 in Diagnosing Problems
Test yourself on Diagnosing Problems
The full Cisco CCST 100-150 Networking question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.