Learning Network Traffic Analysis with Wireshark: My First Practical Investigation
A hands-on networking exercise exploring DNS, TLS, TCP, IP addressing and network conversations. Introduction Understanding how devices communicate across a network is an important skill in networking and cybersecurity. For my second practical technical challenge, I installed Wireshark, an open-source network protocol analyzer, and used it to inspect traffic generated by my own computer over…
This article documents a personal learning exercise where the author used Wireshark, an open-source network protocol analyzer, to inspect traffic generated by their own computer over Wi-Fi. The goal was to understand what happens when devices communicate over a network, not to investigate a confirmed cyberattack.
The author installed Wireshark on a Windows 11 operating system and started a live packet capture on their active Wi-Fi interface. The capture duration was approximately 30 seconds, resulting in 145 initial packets captured.
Through examining DNS, TLS, TCP connection establishment, IP addresses, endpoints, TCP conversations, and TCP reset investigation, the author gained a basic understanding of key networking concepts.
DNS analysis helped identify which domains a device attempts to resolve and correlate those domains with returned IP addresses. TLS traffic revealed useful metadata and handshake information, even when content is encrypted. TCP connection establishment involved a three-way handshake process (SYN, SYN-ACK, ACK). The author learned to distinguish between private and public IPv4 addressing.
Endpoint statistics showed the highest observed packet count belonged to the author's own computer. TCP conversation analysis demonstrated communication between individual pairs of endpoints. No TCP reset packets were observed in this particular capture.
The author emphasizes that unusual traffic does not automatically mean malicious activity and stresses the importance of context, identifying the source, understanding communication patterns, and gathering supporting evidence before drawing conclusions. The exercise was limited to a short capture and should not be considered a full network security assessment.
Overall, this hands-on technical challenge provided the author with practical experience using Wireshark to understand network communication, moving beyond networking theory to actually see what happens when devices communicate over Wi-Fi.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
