Wireshark: what it is, traffic analysis and packet capture

What is Wireshark and how it works

Wireshark is an open-source program (GPLv2) that captures data packets passing through a computer's network interface. It is based on the libpcap library (Unix) or Npcap (Windows) for capture at the data link layer of the OSI model.

Packet capture principle

In normal mode, a network card only receives frames addressed to its MAC address. Wireshark switches the interface into promiscuous mode, in which the system processes all passing frames regardless of the destination. The captured data is passed to the kernel through a raw socket, after which the libpcap library copies it to user space for analysis.

Processing architecture

Wireshark uses a modular architecture: each protocol is implemented as a separate dissector — a plugin that parses binary data and displays it in a structured form. As of 2026, the program implements dissectors for 2,874 protocols, including HTTP/2, QUIC, gRPC and MQTT. The dissectors work through a protocol tree system — each packet is parsed layer by layer: from the Ethernet frame to the application layer.

// Example of a simple dissector for a custom protocol
static int dissect_custom(tvbuff_t *tvb, packet_info *pinfo,
        proto_tree *tree, void *data) {
    proto_item *ti = proto_tree_add_item(tree, hf_custom_field,
            tvb, 0, tvb_captured_length(tvb), ENC_NA);
    return 0;
}

Main Wireshark features

The graphical interface of Wireshark is divided into three panels: packet list, packet details and hex dump (packet bytes). Each panel updates in real time and supports interactive navigation — clicking a packet row opens its full structure.

Supported formats and protocols

The tool reads capture files in pcap, pcapng, snoop and NetMon formats. Export is possible to JSON, XML, CSV and plain text. Among the key application-layer protocols are HTTP/HTTPS, DNS, DHCP, TCP, UDP, TLS, QUIC, WebSocket, MQTT, AMQP and Protobuf. For mobile development, support for gRPC and HTTP/2 with stream multiplexing is especially important.

Analysis tools

Built-in utilities include Follow Stream (reconstructing the full TCP/UDP/TLS dialog), IO Graph (throughput chart), Conversations statistics and Protocol Hierarchy. The Flow Graph feature visualizes the sequence of packets between nodes, which simplifies finding the causes of delays when debugging client-server interaction.

How to capture traffic with Wireshark

Starting a capture begins with selecting a network interface — Ethernet, Wi-Fi, Bluetooth PAN or Loopback. On Windows, you may need to install Npcap in WinPcap API Compatible Mode. For capture on mobile devices, Remote Packet Capture over an SSH tunnel is used.

Capture on a remote device

On an Android device, traffic is captured with tcpdump or PCAPdroid and then transferred to a workstation. The command for remote capture via ADB:

# Capturing traffic on Android via ADB shell
adb shell tcpdump -i wlan0 -s 0 -w /sdcard/capture.pcap
# Copying to the computer
adb pull /sdcard/capture.pcap .

Capturing Loopback traffic

On Windows, localhost (127.0.0.1) traffic does not pass through a physical interface, so Wireshark does not see it directly. The solution is to install Npcap with the Loopback Support option or redirect traffic through RawCap. On Linux and macOS, the loopback interface (lo) is captured without additional setup.

Packet filtering in Wireshark

Wireshark offers two types of filters: capture filters (applied before capture, at the libpcap level) and display filters (applied to already captured data). Capture filters use the BPF (Berkeley Packet Filter) syntax, display filters use Wireshark's own language with autocompletion.

Capture Filters (BPF)

BPF filters are written in tcpdump format and run in the kernel, which minimizes packet loss under heavy load. Filter examples:

Display Filters

Display filters are applied after the fact and support complex conditions with the logical operators and, or, not. For example: http.request.method == "POST" and ip.src == 192.168.0.100 will filter only POST requests from a specific IP. Filters can be saved as favorites for reuse.

Analyzing HTTP and HTTPS traffic

HTTP traffic is displayed in Wireshark in a readable form: request method, URI, headers and response body. The Follow TCP Stream feature collects the complete client-server dialog in a single window. For HTTPS, TLS session decryption is required because the content is encrypted.

Decrypting HTTPS with SSLKEYLOGFILE

Chrome and Firefox browsers support the SSLKEYLOGFILE environment variable, which writes TLS session keys to a text file. Wireshark uses this file to decrypt records. The configuration is done through Preferences → Protocols → TLS → (Pre)-Master-Secret log filename.

# Launching Chrome with TLS key logging
export SSLKEYLOGFILE=/tmp/sslkeys.log
google-chrome .

# After the capture, specify the path in Wireshark
# Edit → Preferences → Protocols → TLS → Log Filename

Analyzing gRPC and Protobuf

gRPC uses HTTP/2 as transport and Protobuf for data serialization. Wireshark decrypts gRPC messages if you provide a .proto file with the structure definitions. The Protobuf dissector maps binary fields to names from the proto file, which is critical when debugging a microservice architecture.

Debugging mobile apps with Wireshark

Mobile debugging with Wireshark requires proxying the device's traffic to the computer. The most reliable method is creating a Wi-Fi hotspot on a laptop and redirecting traffic through NAT. On Android, a VPN method with the PCAPdroid app is also available without root rights.

Setup on Android without root

PCAPdroid creates a local VPN service that redirects app traffic to Wireshark through a UDP stream. The app does not require root access and supports filtering by individual processes. The resulting pcap files are opened in Wireshark for full analysis.

# Receiving traffic from PCAPdroid on the computer
# PCAPdroid → Settings → PCAP dumper → UDP Exporter
nc -l -u 192.168.0.10 12345 > capture.pcap

Comparing Wireshark with alternatives

Wireshark is a universal tool, but more specialized solutions exist for specific tasks. tcpdump is more effective for server-side capture without graphics, Charles Proxy is more convenient for analyzing HTTPS traffic, and Fiddler is more suitable for inspecting web traffic with the ability to modify requests on the fly.

Charles Proxy vs Wireshark

Charles Proxy acts as an intermediate proxy server with the ability to intercept HTTPS through its own SSL certificate handling. Unlike Wireshark, Charles does not require SSLKEYLOGFILE configuration and can not only view but also modify traffic — replace responses, emulate delays and replay requests.

Fiddler Everywhere

Fiddler is another proxy tool popular in the .NET ecosystem. It provides a built-in request editor, AutoResponder support for mocks and a composer for creating custom requests. Fiddler is better suited for analyzing browser web traffic, while Wireshark is better for low-level network analysis.

Practical tips for working with Wireshark

Wireshark requires an understanding of the basic principles of traffic capture. One common scenario is finding the source of delays in a mobile app using the tcp.analysis.ack_rtt filter. To find slow HTTP requests, use the http.time condition greater than 1.

Finding slow requests

To find slow HTTP requests, filter http.time greater than 1 — Wireshark will show requests with a response time of more than 1 second. Combine it with ip.addr to analyze a specific server. An IO Graph with a 1-second interval will clearly show load peaks.

Export and reporting

Wireshark supports export to CSV, JSON and XML through the File menu. For automatic analysis, use tshark — the console version that works in CI/CD pipelines. Tshark supports the same filters and output formats as the graphical version.

Practical tips for working with Wireshark

Wireshark requires an understanding of the basic principles of traffic capture. One common scenario is finding the source of delays in a mobile app using the tcp.analysis.ack_rtt filter. To find slow HTTP requests, use the http.time condition greater than 1.

Finding slow requests

To find slow HTTP requests, filter http.time greater than 1 — Wireshark will show requests with a response time of more than 1 second. Combine it with ip.addr to analyze a specific server. An IO Graph with a 1-second interval will clearly show load peaks.

Export and reporting

Wireshark supports export to CSV, JSON and XML through the File menu. For automatic analysis, use tshark — the console version that works in CI/CD pipelines. Tshark supports the same filters and output formats as the graphical version.