Visually we see that here 3 Way Handshake of packet capture When making a new connection from my machine (A) to (B) the handshake looks roughly like thisĪ – > B (flag: SYN) – A is telling B it wants to make a new connection.ī -> A (flag: SYN+ACK) – B is telling A it “ACKnowledges” the original SYN and agrees to the connection with its own SYNĪ -> B (flag: SYN) – A is telling B it ACKs the SYN from B It uses flags or options to help keep track of the connection. In TCP, it is a stateful connection protocol. The first step to any TCP connection like HTTPS is a 3-way handshake. It filters what you are displaying but all the other packets it captured are still there. The capture filter restricts the packets that wireshark even sees coming from pcap. This helps us narrow down to just the packets necessary that we want to analyze.

* Connected to (2606:4700:20::681a:d78) port 443 (#0)Īfter running curl we want to click the red square button in wireshark to stop the capture. I am using curl -v so that I can see the IP address. Next I will curl or make a connection to Be careful though as filtering too much can lead to not capturing the intended packets. We want to limit the capture as much as possible because there will be a lot of traffic without a filter. Filter based on port 443 for HTTPS and on the Wi-Fi adapter. If you type the capture filter first and then change the adapter the filter will clear. If you’re unsure of which one, you can see the traffic graph (squiggly lines). First we need to select the adapter though. Here we will filter based on port 443 as we intend to make a connection to on port 443.

UNIX like operating systems already come with the necessary libraries.

That is what allows the packets to actually get captured on windows. On the machine you want to perform the capture on, make sure winpcap or now npcap are installed. On the installation, most of the defaults should work. You can find a full history of that on their Wikipedia page – Installing Wireshark In 1998 it was called ethereal but had to change its name. Wireshark has been around for quite some time. Many times the packet capture can seem like a needle in a haystack. This guide is designed for someone that has never performed a packet capture before or may have had to a few times but really did not understand it.

Wireshark capture filter for https