Wireshark User's Guide

What it covers

The Wireshark documentation hub at wireshark.org/docs links the User's Guide, the Developer's Guide, command-line manual pages for Wireshark, tshark, dumpcap and the other bundled tools, and a full Display Filter Reference covering every protocol dissector's fields. The User's Guide walks through installing Wireshark, capturing traffic on a live interface, opening saved capture files, building and saving display and capture filters, following TCP streams, and exporting objects such as files transferred over HTTP.

Who it is for

Anyone who needs to look inside network traffic: students learning how protocols actually behave on the wire, security analysts investigating suspicious traffic, and developers debugging why two systems are not talking to each other correctly. The guide assumes no prior Wireshark experience but does assume you already know roughly what a protocol like TCP, DNS or HTTP is for.

How to use it

Start with the User's Guide chapters on capturing and on display filters, since almost everything else builds on those two skills. Keep the Display Filter Reference open in a separate tab while you work, since filter syntax varies by protocol and is easy to get wrong from memory. The command-line manual pages matter once you move beyond the graphical interface to tshark for scripted or headless capture.

Prerequisites

Basic networking concepts help a lot: knowing what a port, an IP address and the OSI layers are will make the material click faster. No programming is required to use the guide, though the Developer's Guide assumes C or Lua if you want to extend Wireshark itself.

Free versus paid

Wireshark and its full documentation are free and open source, with no paid tier. The project accepts donations and runs a paid annual conference, SharkFest, for people who want in-person training, but nothing in the documentation itself sits behind a paywall.

Capturing traffic responsibly

Capturing network traffic you do not own or are not authorised to monitor, including on shared or workplace networks, can breach privacy law and workplace policy even when it is technically easy to do. Practise on your own devices, a home lab, or traffic you have explicit permission to capture.

Common questions

Do I need admin or root access? Yes, live packet capture typically requires elevated privileges or a properly configured capture group, which the User's Guide explains for each operating system.

Can I analyse someone else's capture file without capturing it myself? Yes, opening a saved capture file someone else made needs no special privileges, which is how most training exercises work.

Is there a lighter alternative for scripted use? tshark, Wireshark's command-line sibling documented in the same set of manual pages, is built for exactly that.