Install Wireshark: Windows, Linux, and macOS Guide

Wireshark is the world’s most popular network protocol analyzer. Whether you’re a cybersecurity student, a system administrator, or a bug bounty hunter, Wireshark helps you see exactly what’s happening on your network at a microscopic level.

In this Wireshark tutorial for beginners, you’ll learn:

• How to install Wireshark on Windows, Linux, and macOS.
• The basics of capturing and analyzing packets.
• How to use display filters to find malicious traffic.

Let’s dive in.

What is Wireshark?

Wireshark captures packets traveling through a network interface (Ethernet, Wi-Fi, loopback). It decodes hundreds of protocols — from HTTP and DNS to TLS and TCP — allowing you to inspect payloads, headers, and timing.

⚠️ Legal Warning: Only capture traffic on networks you own or have explicit permission to monitor. Unauthorized packet sniffing is illegal in most jurisdictions.

Part 1: How to Install Wireshark

🪟 Windows Installation

1. Download the latest stable installer from wireshark.org.
2. Run the .exe file as administrator.
3. Accept the license agreement.
4. Select installation components (defaults are fine).
5. Important: When prompted about Npcap, keep it checked — Npcap allows Wireshark to capture live packets.
6. Complete installation and reboot if required.

🐧 Linux Installation

Ubuntu / Debian (APT)

sudo apt update
sudo apt install wireshark -y

During installation, select “Yes” when asked if non-root users should capture packets. Then add your user to the wireshark group:

sudo usermod -aG wireshark $USER

Log out and back in.

Fedora / RHEL (DNF)

sudo dnf install wireshark -y

Arch Linux (Pacman)

sudo pacman -S wireshark-qt

🍎 macOS Installation

1. Download the macOS .dmg from wireshark.org.
2. Open the DMG and drag Wireshark to your Applications folder.
3. Launch Wireshark. If you see “No interfaces available”:
   • Install ChmodBPF from the DMG, or
   • Run in terminal: sudo chmod 644 /dev/bpf*

✅ First Launch Tip: Always run Wireshark with normal privileges, not as root. The installer sets up proper permissions on all platforms.

Part 2: Wireshark Tutorial for Beginners

Step 1: Choose a Network Interface

1. Open Wireshark.
2. You’ll see a list of active network interfaces (Wi-Fi, Ethernet, Bluetooth, etc.).
3. Select the interface you want to capture traffic from (usually your active internet connection).
4. Click the blue shark fin icon (top-left) to start capture.

Step 2: Stop a Capture & Save Data

• Click the red square to stop capture.
• Save your capture as a .pcapng file (File → Save As). This allows later analysis.

Step 3: The 3 Main Panels (Essential for Beginners)

Step 4: Color Coding

Wireshark uses colors to help identify traffic:

• Light purple → TCP traffic
• Light blue → UDP traffic
• Green → HTTP traffic
• Dark yellow → Routing protocols
• Black/Red → Malformed packets (potential errors or attacks)

Step 5: Using Display Filters (The Most Important Skill)

Filters hide irrelevant traffic. Type directly into the filter bar (green when valid, red when wrong).

💡 Beginner Pro Tip: Right-click any packet → “Apply as Filter” → “Selected” to auto-build filters.

Step 6: Follow a Stream

To reconstruct a conversation (e.g., an HTTP request/response or a chat message):

1. Right-click any packet belonging to the stream.
2. Choose Follow → TCP Stream (or UDP/HTTP).
3. A new window shows the full conversation in both directions.

This is how analysts extract stolen credentials or view unencrypted web traffic.

Part 3: Practical Example — Capturing Your First HTTP Request

Let’s see a real-world example.

1. Start capture on your Wi-Fi interface.
2. Open a browser and visit http://neverssl.com (this forces plain HTTP).
3. Stop capture in Wireshark.
4. Apply filter: http
5. Select the GET / packet.
6. Expand the Packet Details → Hypertext Transfer Protocol.
7. You’ll see the User-Agent, Host, and Accept headers.

Now try Follow → TCP Stream to see the full HTTP response HTML.

Part 4: 3 Beginner Mistakes to Avoid

1. Capturing too much data → Use capture filters (not display filters) during recording.
   Example capture filter: host 8.8.8.8 (only traffic to/from Google DNS).
2. Ignoring promiscuous mode → Uncheck “Capture packets in promiscuous mode” unless you need to see traffic not destined for your MAC address.
3. Not using display filters → Beginners scroll endlessly. Master filters to save hours.

Bonus: Useful Wireshark Shortcuts

Final Thoughts

This Wireshark tutorial for beginners gives you a solid foundation. With these installation steps and core skills, you can now:

• Install Wireshark on any major OS.
• Capture live traffic.
• Apply display filters.
• Follow streams to analyze conversations.

Next steps for your cybersecurity journey:

• Learn about TLS decryption (Wireshark can decrypt HTTPS with private keys).
• Practice with sample PCAPs from Malware Traffic Analysis or Wireshark’s sample captures.
• Audit captured network passwords offline using our John the Ripper Tutorial.
• Combine Wireshark with TShark (CLI version) for automation.

🔗 Share this post: If this guide helped you, share it with a fellow cybersecurity beginner. Have questions? Leave a comment below.