5.2Packet capture with Wireshark

The ping and nslookup you learn elsewhere confirm "does it connect?" and "can a name be resolved?", but they do not show what packets are actually being exchanged. This is where a packet analyzer comes in, the classic example being the free and widely used Wireshark. This section covers, at an introductory level, the purpose of a packet analyzer that captures communication packet by packet and visualizes its contents (source, destination, protocol, and payload), and the basic workflow of saving a capture as a .pcap file and reopening it later for analysis.

5.2.1The purpose of a packet analyzer

• A packet analyzer is software that captures traffic on the network packet by packet and shows its contents. You can see source/destination addresses, the protocols in use (TCP/UDP/DNS, etc.), and even the exchange itself; Wireshark is the leading example.
• The purpose is to confirm with your own eyes "what is actually happening." ping tells you only up or down, but a capture reveals a deeper cause—"the request goes out but no reply returns," or "another protocol is interrupting midway."
• To capture, select the target interface and start. Because a flood of packets flows, filtering (e.g., ip.addr 192.168.1.10 or dns) to narrow down to only the traffic of interest is the practical basic.

5.2.2Saving and opening .pcap files

• A .pcap file is the standard file format for saving captured traffic (short for packet capture). Beyond viewing in the moment, saving to a file lets you reopen and analyze it any number of times later and share it with others.
• A typical use is to save on-site traffic as a .pcap and send it to a senior engineer or vendor. Even if you cannot find the cause yourself, a .pcap as evidence lets an expert reproduce and follow the exact same traffic.
• A saved .pcap opens in Wireshark on another PC too. Being able to separate where you capture (the site of the problem) from where you analyze (in the hands of an expert) is a major benefit of keeping it as a file.

Suppose a web app has a problem where users can reach it but only login fails, and you have already confirmed with ping that the server is reachable. Concluding "ping works, so the network is fine—this must be an app problem" is premature. A packet analyzer lets you check the actual contents of the traffic before that verdict. You launch Wireshark on the client PC, start a capture on the target interface, and try logging in again. Filtering the captured packets by DNS or HTTPS (TCP 443) may surface a fact impossible to see from ping alone—"the login request is sent to the server, but the server's reply does not come back at a particular stage." The key posture is not to rush to a verdict but to first capture, as evidence, what is flowing. Then you save that traffic as a .pcap file. An introductory-level technician can use this .pcap to hand the case up with concrete facts attached: "ping works, but the HTTPS login reply is missing at a specific stage." Even if you cannot analyze everything yourself, being able to leave a shareable piece of evidence—a .pcap—itself greatly advances isolation and handoff.

5.2.3Section summary

• A packet analyzer (Wireshark) captures traffic packet by packet and visualizes source/destination/protocol/contents
• Whereas ping shows only up/down, a capture reveals the contents—what is actually flowing
• A capture can be saved as a .pcap file, reopened later or on another PC, and shared/handed off as evidence