🦈

Watch your network talk

Like reading your computer's group chat. It's surprisingly chatty.

Everything on a network is a conversation. Wireshark lets you listen in on your own computer's conversations, so the things you've only read about (DNS, the TCP handshake, HTTP) appear right in front of you.

Beginner1 hourWireshark

🧰 What you need

A laptop or desktop (Windows, macOS or Linux)
Wireshark (free)

Let's build it

Install Wireshark

Accept the defaults. On Windows, let it install Npcap; that's the part that actually captures packets.

Start capturing

Open Wireshark and double-click the interface you're connected on, usually Wi-Fi or Ethernet; it's the one with a moving line next to it. Packets start scrolling immediately. Your computer is busier than you thought.

Clear your DNS cache

So your computer has to ask for names again:

# Windows
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Find the DNS question

Type dns into the filter bar and press Enter. Now visit http://neverssl.com. You'll see your computer ask "where is neverssl.com?" and the answer come back with an IP address.

Watch the handshake

Change the filter to:

tcp.flags.syn == 1

These are the first two moves of TCP's three-way handshake: your SYN ("can we talk?") and the server's SYN, ACK ("yes, can you hear me?"). The third move, your ACK, follows right after.

Read the conversation

Filter on http, right-click the GET request → Follow → HTTP Stream. You're reading the exact words your browser and the server said to each other.

✅ How you know it worked

You can point at three things on screen: the DNS question and answer, the SYN / SYN-ACK / ACK handshake, and the HTTP GET with its 200 OK reply.

💥 Break it on purpose

Now visit an https:// site and try the same thing. You'll still see DNS and the handshake, but the conversation itself is unreadable, because it's encrypted with TLS. That's why the padlock matters, and it's the reason this lab uses neverssl.com.

🧠 What's really going on

Your network card normally ignores everything not meant for it and hands your apps only the data they asked for. Wireshark gets a copy of every packet before that happens and decodes each layer: Ethernet, then IP, then TCP or UDP, then the application on top. Filters just hide what you're not looking at; everything is still being captured.

← Back to all network labs · Stuck? Email me