Install Wireshark: The 2026 Windows, Linux, and macOS Guide

Wireshark is the world’s most popular network protocol analyzer. Whether you are a cybersecurity student, an experienced system administrator, or a bug bounty hunter, Wireshark helps you see what is happening on your network at a forensic level.

In this Wireshark tutorial for beginners, you will learn:

• How to install Wireshark on Windows, Linux, and macOS.
• The fundamentals of capturing and analyzing network packets.
• How to use display filters to find hidden network traffic.
• How to reconstruct TCP streams to extract sensitive information.

Let’s dive in.

What is Wireshark?

Wireshark captures raw network packets traveling through a network interface (Ethernet, Wi-Fi, or local loopback). It decodes hundreds of different network protocols — from HTTP and DNS to TLS and TCP — allowing you to inspect payloads, headers, and timing.

⚠️ LEGAL WARNING: You must only capture network traffic on networks you own or have explicit written permission to monitor. Unauthorized packet sniffing is illegal in most jurisdictions.

Part 1: How to Install Wireshark

🪟 Windows 11 Installation

1. Download the latest .exe installer directly from wireshark.org.
2. Run the .exe file as an administrator.
3. Accept the license agreement.
4. Select the recommended installation components (the defaults are fine).
5. Important: When prompted about the Npcap driver, keep it checked — Npcap allows Wireshark to capture live network packets directly from the Windows kernel.
6. Complete the installation and reboot your system if required.

🐧 Linux Installation

Ubuntu / Debian (APT)

sudo apt update
sudo apt install wireshark -y

During the installation, select “Yes” when asked if non-root users should be allowed to capture packets. Then add your user to the wireshark group:

sudo usermod -aG wireshark $USER

Log out and log back in to apply the group changes.

Fedora / RHEL (DNF)

sudo dnf install wireshark -y

Arch Linux (Pacman)

sudo pacman -S wireshark-qt

🍎 macOS Installation

1. Download the macOS .dmg package directly from wireshark.org.
2. Open the DMG and drag the Wireshark application to your Applications folder.
3. Launch Wireshark. If you see “No active interfaces available”:
   • Install the ChmodBPF package directly from the DMG, or
   • Run in your terminal: sudo chmod 644 /dev/bpf*

✅ First Launch Pro Tip: Always run Wireshark with standard privileges, never as the root user. The installer sets up proper permissions on all major platforms.

Part 2: The Ultimate Wireshark guide for Beginners

Step 1: Choose a Network Interface

1. Open the Wireshark application.
2. You will see a list of active network interfaces (Wi-Fi, Ethernet, Bluetooth, local loopback, etc.).
3. Select the interface you want to capture traffic from (usually your active internet connection).
4. Click the blue shark fin icon (top-left) to start the packet capture.

Step 2: Stop a Capture & Save Data

• Click the red square icon to stop the packet capture.
• Save your capture as a .pcapng file (Navigate to File → Save As). This allows for forensic analysis later at your convenience.

Step 3: The 3 Main Panels (Essential for Beginners)

Step 4: Color Coding

Wireshark uses colors to help you identify network traffic:

• Light purple → TCP traffic
• Light blue → UDP traffic
• Green → HTTP traffic
• Dark yellow → Routing protocols
• Black/Red → Malformed or broken packets (indicating potential errors or attacks)

Step 5: Using Display Filters (The Most Important Skill)

Display filters hide irrelevant or noisy traffic. Simply type directly into the filter bar (it turns green when valid, and red when invalid).

💡 Pro Tip: Right-click any packet → “Apply as Filter” → “Selected” to automatically build filters.

Step 6: Follow a TCP Stream

To reconstruct an entire conversation (e.g., an HTTP request/response or a chat message):

1. Right-click any packet belonging to the stream.
2. Choose Follow → TCP Stream (or UDP/HTTP).
3. A new window shows the entire conversation in both directions.

This is how analysts extract sensitive credentials or view unencrypted web traffic.

Part 3: Practical Example — Capturing Your First HTTP Request

Let’s see a practical example.

1. Start a packet capture on your Wi-Fi interface.
2. Open a web browser and visit http://neverssl.com (this forces plain, unencrypted HTTP).
3. Stop the packet capture in Wireshark.
4. Apply the filter: http
5. Select the GET / packet.
6. Expand Packet Details → Hypertext Transfer Protocol.
7. You will see the User-Agent, Host, and Accept headers.

Now try Follow → TCP Stream to see the entire HTTP response raw HTML code.

Part 4: 3 Beginner Mistakes to Avoid

1. Capturing too much data → Use specific capture filters (not display filters) during the recording to limit data.
   Example capture filter: host 8.8.8.8 (only traffic to/from Google DNS).
2. Ignoring promiscuous mode → Uncheck “Capture packets in promiscuous mode” unless you need to see traffic not destined for your MAC address.
3. Not using display filters → Beginners manually scroll endlessly. You must master display filters to save time.

Bonus: Useful Wireshark Shortcuts

Final Thoughts

This Wireshark guide for beginners gives you a solid foundation. With these installation steps and fundamental skills, you can now:

• Install Wireshark on any major OS.
• Capture live network traffic.
• Apply display filters.
• Follow TCP streams to analyze conversations.

Next steps for your cybersecurity journey:

• Learn about TLS decryption (Wireshark can decrypt HTTPS traffic with private keys).
• Practice with sample PCAPs from Malware Traffic Analysis or Wireshark’s sample captures.
• Audit captured network passwords offline using our John the Ripper guide.
• Combine Wireshark with TShark (the CLI version) for Python automation.

🔗 Share this post: If this guide helped you, share it with a fellow cybersecurity beginner. Have questions? Leave a comment below.

Frequently Asked Questions (FAQ)

What is Wireshark and what is it used for?

Wireshark is the world’s most popular network protocol analyzer. It captures raw network packets traveling through a network interface and decodes them, allowing you to inspect payloads, headers, and network traffic for troubleshooting and security analysis.

Is it illegal to use Wireshark to capture network packets?

It is illegal in most jurisdictions to capture network traffic on networks you do not own or do not have explicit written permission to monitor. You must only sniff packets on authorized networks.

Why is the Npcap driver required when installing Wireshark on Windows?

The Npcap driver is essential on Windows because it allows Wireshark to capture live network packets directly from the Windows kernel.

How can I view a complete HTTP conversation in Wireshark?

To reconstruct an entire conversation, right-click any packet belonging to the stream and select “Follow”, then “TCP Stream” (or HTTP). This opens a new window showing the entire conversation in both directions.

What do the red and black colors mean in Wireshark?

In Wireshark’s default color coding scheme, black and red colors generally indicate malformed or broken packets, which could signify potential network errors or cyber attacks.