Espressif Wireshark User Guide
1. Overview
1.1 What Is Wireshark?
Wireshark (originally named "Ethereal") is a network packet analyzer that captures network packets and displays the packet data as detailed as possible. It uses libpcap (on Linux and other Unix-like systems) or Npcap (on Windows) to directly capture network traffic going through a network interface controller (NIC).
You could think of a network packet analyzer as a measuring device used to examine what is going on inside a network cable, just like a voltmeter is used by an electrician to examine what is going on inside an electric cable.
In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed.
Wireshark is released under the terms of the GNU General Public License, which means you can use the software and the source code free of charge. It also allows you to modify and customize the source code.
Wireshark is, perhaps, one of the best open source packet analyzers available today.
1.2 Some Intended Purposes
Here are some examples of how Wireshark is typically used:
Network administrators use it to troubleshoot network problems.
Network security engineers use it to examine security problems.
Developers use it to debug protocol implementations.
People use it to learn more about network protocol internals.
Beside these examples, Wireshark can be used for many other purposes.
1.3 Features
The main features of Wireshark are as follows:
Available for Linux, macOS, and Windows
Captures live packet data from a network interface
Displays packets along with detailed protocol information
Opens/saves the captured packet data
Imports/exports packets into a number of file formats, supported by other capture programs
Advanced packet filtering
Searches for packets based on multiple criteria
Colorizes packets according to display filters
Calculates statistics
... and a lot more!
1.4 Wireshark Can or Cannot Do
Live capture from different network media.
Wireshark can capture traffic from different network media, including wireless LAN (requires monitor mode support on the hardware).
Import files from many other capture programs.
Wireshark can import data from a large number of file formats, supported by other capture programs.
Export files for many other capture programs.
Wireshark can export data into a large number of file formats, supported by other capture programs.
Numerous protocol dissectors.
Wireshark can dissect, or decode, a large number of protocols.
Wireshark is not an intrusion detection system.
It will not warn you if there are any suspicious activities on your network. However, if strange things happen, Wireshark might help you figure out what is really going on.
Wireshark does not manipulate processes on the network, it can only perform "measurements" within it.
Wireshark does not send packets on the network or influence it in any other way, except for resolving names (converting numerical address values into a human readable format), but even that can be disabled.
2. Where to Get Wireshark
You can get Wireshark from the official website: https://www.wireshark.org/download.html
Wireshark can run on Linux, macOS, and Windows. Please download the correct version according to the operating system you are using. On Windows, the installer includes Npcap (the packet capture library); on Linux, ensure libpcap is installed.
3. Step-by-step Guide
This demonstration uses Wireshark on Linux. The UI may vary slightly between versions; the latest documentation is available at Wireshark User's Guide.
a) Start Wireshark
To find your wireless NIC name (e.g., wlan0), run ip link show or iw dev to list available interfaces.
On Linux, you can run the shell script provided below. It starts Wireshark and configures the NIC for packet capture in monitor mode. These commands require root privileges—run the script with sudo or as root:
ip link set $1 down
iw dev $1 set type monitor
ip link set $1 up
wireshark &
Note
Setting a specific channel (e.g., iw dev $1 set channel 6) limits capture to that channel only. The script above omits that command, so capture stays on the interface's current channel. To capture on a specific channel, add iw dev $1 set channel 6 (or another channel) between the set type monitor and ip link set $1 up lines.
In the above script, the parameter $1 represents the NIC (e.g., wlan0). For example, ./xxx.sh wlan0 starts capture on the wireless interface.
b) Run the Shell Script to Open Wireshark and Display Capture Interface
Wireshark Capture Interface
c) Select the Interface to Start Packet Capture
As the red markup shows in the picture above, many interfaces are available. The first one is a local NIC and the second one is a wireless NIC.
Please select the NIC according to your requirements. This document will use the wireless NIC to demonstrate packet capture.
Double click wlan0 to start packet capture.
d) Set up Filters
Since all packets in the channel will be captured, and many of them are not needed, you have to set up filters to get the packets that you need.
Some commonly used display filters for wireless capture:
wlan.ssid == "MyNetwork"— filter by SSID (network name)wlan.addr == aa:bb:cc:dd:ee:ff— filter by MAC address (source, destination, or BSSID)wlan.bssid == aa:bb:cc:dd:ee:ff— filter by access point BSSIDwlan.fc.type_subtype == 0x08— filter beacon frameseapol— filter EAPOL handshake packets (needed for WPA decryption)
Please find the picture below with the red markup, indicating where the filters should be set up.
Setting up Filters in Wireshark
Click Filter, the top left blue button in the picture below. The display filter dialogue box will appear.
Display Filter Dialogue Box
Click the Expression button to bring up the Filter Expression dialogue box and set the filter according to your requirements.
Filter Expression Dialogue Box
The quickest way: enter the filters directly in the toolbar.
Filter Toolbar
Click on this area to enter or modify the filters. If you enter a wrong or unfinished filter, the built-in syntax check turns the background red. As soon as the correct expression is entered, the background becomes green.
The previously entered filters are automatically saved. You can access them anytime by opening the drop down list.
For example, as shown in the picture below, enter two MAC addresses as the filters and click Apply (the blue arrow). In this case, only the packet data transmitted between these two MAC addresses will be captured.
Example of MAC Addresses applied in the Filter Toolbar
Decryption keys for encrypted Wi-Fi traffic
To view decrypted traffic after a successful Wi-Fi connection (WPA/WPA2-Personal), configure decryption keys in Wireshark:
Go to Edit → Preferences → Protocols → IEEE 802.11
Click Edit next to Decryption Keys
Add keys according to the format below (ensure Enable decryption is checked)
Common decryption key formats:
Key type |
Key format / example |
|---|---|
wpa-pwd |
|
wep |
Hexadecimal key, e.g., |
Note
For WPA/WPA2-Personal, the capture must include the 4-way EAPOL handshake (when the device joins the network). Use the eapol display filter to verify handshake packets are present. See the Wireshark 802.11 documentation for more details.
e) Packet List
You can click any packet in the packet list and check the detailed information about it in the box below the list. For example, if you click the first packet, its details will appear in that box.
Example of Packet List Details
f) Stop/Start Packet Capture
As shown in the picture below, click the red button to stop capturing the current packet.
Stopping Packet Capture
Click the top left blue button to start or resume packet capture.
Starting or Resuming the Packets Capture
g) Save the Current Packet
On Linux, go to File → Export Packet Dissections → as Plain Text to save the packet.
Saving Captured Packets
Please note that All packets, Displayed and All expanded must be selected.
By default, Wireshark saves the captured packet in a libpcap file. You can also save the file in other formats, e.g., txt, to analyze it in other tools.