Wireshark records network packets that pass through a selected interface and separates each packet into protocol fields. A capture can contain Ethernet frames, IP addresses, TCP conversations, DNS requests, and the raw bytes that carried them. Wireshark does not create traffic or repair a connection. It gives the user a packet-level record for explaining what two systems actually exchanged, which is much deeper than the connection status shown by an ordinary browser or operating-system network panel.
Packet capture
A capture begins with an interface rather than a website or application name. The interface list can contain Ethernet, Wi-Fi, loopback, virtual adapters, and interfaces created by VPN or virtualization products. Selecting the wrong one produces an empty capture even while the computer remains online. The useful interface is the one carrying the traffic under investigation.
Wireshark can stop after a chosen packet count, elapsed duration, file size, or number of output files. These limits matter on a busy network because an unrestricted capture can grow quickly. Starting the capture before reproducing a fault preserves the setup traffic, while starting afterward can miss the DNS lookup, connection handshake, or error response that explains the failure.
Two filter languages
A capture filter decides which packets Wireshark records. A display filter works after collection and only changes which recorded packets appear in the window. Hiding packets with a display filter does not remove them from the saved capture. This distinction makes display filtering safer during exploration because another expression can reveal the hidden traffic again.
The two filter types use different syntax. Copying a display expression into the capture-filter box can fail even when the expression works in the packet view. Wireshark checks display-filter syntax before applying it, so a rejected expression needs correction rather than repeated pressing of the Apply action. Saved filter names store frequently used expressions; they do not become labels written into the packets.
Packet layers
The packet list shows one row per captured packet. Selecting a row opens a protocol tree that breaks the bytes into headers and values, while the bytes pane marks the exact portion behind the selected field. Following a TCP stream collects the payload pieces that belong to one conversation and displays them in order. It does not decrypt protected application data without the required session secrets.
Checksums and retransmission indicators need context. Hardware offloading can make a checksum appear incorrect in a packet captured before the network adapter finishes its work. A retransmission can also reflect loss, delay, or duplicate capture points. Wireshark exposes the evidence, but the packet path and capture location still determine what that evidence means.
Names and addresses
Name resolution replaces numeric addresses with known host or service names when the relevant option is active. Wireshark can draw those names from captured traffic, local hosts files, or external lookups. External DNS resolution changes the observation itself because the lookups create additional packets that may enter the capture.
Resolved names remain cached during the running session. Changing a hosts file or DNS record does not guarantee that an already displayed name changes immediately. Numeric addresses remain the stable reference when a name looks stale or points to several systems.
Saved traffic
A saved pcapng file keeps the captured packets for later analysis. It can also carry capture metadata that a plain text export cannot preserve. Sharing that file may expose addresses, host names, account identifiers, requests, and unencrypted payload content. Applying a display filter before saving does not automatically strip the hidden packets, so sensitive captures need deliberate packet removal or a limited capture at collection time.
