Packets do not lie, but they are easy to misread. Wireshark turns a capture into a conversation you can inspect, provided you capture the right traffic and filter it deliberately.
Capture versus display filters
- Capture filters decide what is written to the file. They use BPF syntax:
tcp port 443. - Display filters hide packets from view without deleting them:
dns,http.request,tcp.flags.reset == 1.
Start broad enough to keep the evidence, then narrow the view.
Following a conversation
- Find the relevant packet.
- Right-click → Follow → TCP or UDP stream.
- Read the application data in order.
For HTTP, this can reveal request paths and responses. For TLS, the payload is encrypted; you see metadata, not content.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.