Here you can see that I have multiple interfaces to filter from you may have more or fewer interfaces than I have. The first screen that we are greeted by when opening Wireshark is the main page that will allow us to specify our interface(s) as well as apply filters to narrow down traffic that we are capturing. Note: Wireshark can come with other packages and tools you can decide whether or not you want to install them along with Wireshark.įor more information about Wireshark check out the Wireshark Documentation. If you are using Linux you can install Wireshark with apt-get install wireshark or a similar package manager. Once you have downloaded an installer, simply run it and follow the GUI wizard. To begin installing Wireshark on a Windows or macOS device you will need to first grab an installer from the Wireshark website. Wireshark can run on Windows, macOS, and Linux. Luckily if you’re using Kali Linux (or the TryHackMe AttackBox) then it is already installed on your machine. The installation for Wireshark is very easy and typically comes with a packaged GUI wizard. If you have a general knowledge of networking basics then you will be ready to begin. All credit goes to the respective owners.īefore completing this room we recommend completing the ‘ Introductory Networking’. PCAPs used in this room have been sourced from the Wireshark Sample Captures Page as well as captures from various members of the TryHackMe community. In this room, we will look at the basics of installing Wireshark and using it to perform basic packet analysis and take a deep look at each common networking protocol. Wireshark, a tool used for creating and analyzing PCAPs (network packet capture files), is commonly used as one of the best packet analysis tools. Have added some stuff, but still all credits goes to the TryHackMe community. This document is a full writeup: The learn material + question + answers + bonus of the amazing Wireshark room.

Wireshark filter by domain name