This guide is for learning. Run these commands only on your own lab or servers.
Wireshark shows the packets moving through a network interface. It is a great way to see how DNS, TCP and HTTP really work.
Legal note: only scan or capture traffic on networks you own or have written permission to test. Doing it on someone else's network is illegal in many countries.
1. Capture
Open Wireshark, pick your lab interface (for example eth0 or a virtual adapter) and press Start. Generate some traffic, such as a ping or a page load on your own test server.
2. Display filters
ip.addr == 192.168.10.5
dns
tcp.port == 80
icmp3. Follow a TCP stream
Right-click a TCP packet and choose Follow, then TCP Stream. You can watch the three-way handshake (SYN, SYN-ACK, ACK) at the start of the capture.
4. Save your work
Save the capture as a .pcapng file and keep it with your lab notes. Remove any real addresses or names before you share a screenshot.
