Wireshark

Content that refers to the Wireshark packet analysis tool.

Using Windows Packet Monitor (Pktmon) for Packet Capture and Analysis

Networking and Computing Tips and Tricks / By

Views: 10,626Originally published May 22, 2020 | Updated November 8, 2026 Back in May 2020, I wrote about a new packet capture utility Microsoft had quietly introduced into Windows 10. It was called Packet Monitor, or pktmon.exe, and it promised something interesting: the ability to capture and troubleshoot network packets without installing additional software. Naturally,

Using Windows Packet Monitor (Pktmon) for Packet Capture and Analysis Read More »

, , , , , , , , ,

Capture Windows Network Traffic Using Netsh and Wireshark

Networking and Computing Tips and Tricks / By

Views: 3,466Originally published January 11, 2017 | Updated November 8, 2026 Did you know that Windows includes a built-in capability for capturing network packets without installing Wireshark, Npcap, or another packet capture application? It’s true, and it has been available for quite a few years. Back in January 2017, I wrote about using the Windows

Capture Windows Network Traffic Using Netsh and Wireshark Read More »

, , , , , , , ,

A TCP State Question

Frequently Asked Questions / By

Views: 247My immediate thought was, well, after sending its FIN, A enters the FIN_WAIT_1 state. If B’s acknowledgment is lost, A remains in FIN_WAIT_1 because its FIN has not yet been acknowledged. If the retransmission timer expires before an acknowledgment arrives, A retransmits its FIN. But, thinking about it some more, wouldn’t A retransmit? I

A TCP State Question Read More »

, , , ,

Capturing Wi-Fi Packets on Windows with Wireshark and Npcap

Networking and Computing Tips and Tricks / By

Views: 8,786Originally published February 22, 2017 | Updated November 2026 Check out these great references as well:   Our Wireless custom profile for Wireshark  Our Udemy course on Wireless Packet capture  Our other Wi-Fi related articles One of the frustrations I have encountered over many years of teaching Wi-Fi troubleshooting and packet analysis is how difficult

Capturing Wi-Fi Packets on Windows with Wireshark and Npcap Read More »

, , , , , , , , ,

Basic PC and Network Troubleshooting Tips That Still Work

Networking and Computing Tips and Tricks / By

Views: 2,018Originally published September 3, 2010. Updated November 2026. Computers have changed considerably since I first published this article in 2010. Windows has evolved, solid-state drives have largely replaced mechanical hard drives, Wi-Fi has become essential, and IPv6 is now an important part of Internet connectivity. What has not changed is the need for effective

Basic PC and Network Troubleshooting Tips That Still Work Read More »

, , , , , , , , , ,

Why Broadband Service Provider Technical Teams Should Be Using Linux in 2026

The CellStream Blog / By

Views: 2,530Originally published August 7, 2018 | Updated October 2026 Several years ago, during a video call with a service provider technical lead, I noticed something interesting. Almost every question I answered, whether it concerned Wi-Fi, network testing, troubleshooting, or packet analysis, involved demonstrating something on my Linux laptop. Eventually, the technical lead asked why

Why Broadband Service Provider Technical Teams Should Be Using Linux in 2026 Read More »

, , , , , , , , , , , , , , , ,

Wireshark Display Filter Cheat Sheet

Networking and Computing Tips and Tricks / By

Views: 348This updated Wireshark Display Filter Cheat Sheet (multi page) is designed as a practical reference for anyone who uses Wireshark for troubleshooting, packet analysis, protocol study, or security work. The original version already covered the basic filter structure, comparison operators, conversation filters, common protocol fields, TCP analysis, Wi-Fi, routing, VoIP, DNS, DHCP, TLS, and

Wireshark Display Filter Cheat Sheet Read More »

, ,

What Can Wireshark Really Tell You About an Encrypted Signal Conversation?

Networking and Computing Tips and Tricks / By

Views: 1,029Signal has a well-earned reputation as a secure messaging application. Messages, voice calls, video calls, files, and other Signal-to-Signal communications are protected using end-to-end encryption. Signal states that message and call contents cannot be accessed by Signal or other third parties because the communications are always end-to-end encrypted. So that raises an interesting Wireshark

What Can Wireshark Really Tell You About an Encrypted Signal Conversation? Read More »

, , , , ,

Why Your Wireshark Filter May Not Mean What You Think It Means

Networking and Computing Tips and Tricks / By

Views: 665Wireshark display filters can look deceptively simple. For example: tcp.port > 1024 seems obvious. But a TCP packet normally has two port values: a source port and a destination port. That means Wireshark may be evaluating more than one value when you write a filter. Consider: This packet satisfies: tcp.port > 1024 because 53000

Why Your Wireshark Filter May Not Mean What You Think It Means Read More »

, ,

10 Wireshark Display Filter Functions You’re Probably Not Using

Networking and Computing Tips and Tricks / By

Views: 621Most Wireshark users learn display filters by comparing a field to a value: ip.addr == 192.168.1.10 tcp.port == 443 dns.qry.name contains “example” But modern Wireshark display filters can do much more than simple comparisons. The filter language includes functions that can measure field lengths, count repeated fields, manipulate text, compare values, and even convert

10 Wireshark Display Filter Functions You’re Probably Not Using Read More »

, , ,

Synchronize Two Wireshark Captures by Correcting Clock Drift

Networking and Computing Tips and Tricks / By

Views: 893I discussed correlating packet captures from multiple capture points last week. In that post, one of the things I promised was to dive deeper into clock offsets and clock drift. When troubleshooting from more than one capture point, it is common to compare traffic from places such as: Before those captures can be compared—or

Synchronize Two Wireshark Captures by Correcting Clock Drift Read More »

, , , ,

Wireshark’s Slice Operator: Search Exact Bytes Without Writing a Dissector

Networking and Computing Tips and Tricks / By

Views: 810Wireshark gives us thousands of protocol fields to filter on: But what happens when the exact information you want isn’t exposed as a field? That is where Wireshark’s Slice Operator becomes extremely useful. A slice lets you select specific bytes from a field, payload, protocol, or even the captured frame itself. For example: eth.src[0:3]

Wireshark’s Slice Operator: Search Exact Bytes Without Writing a Dissector Read More »

, , , ,

Correlating Multiple Wireshark Captures: Follow the Same Packet Across the Network

Networking and Computing Tips and Tricks / By

Views: 1,071So many times I have watched YouTube videos and read articles that jump right into Wireshark troubleshooting of multiple captures of a network conversation or event from multiple points in the network. To me, that can be unnecessarily overwhelming to those learning packet capture. In many videos, it never becomes clear why two different

Correlating Multiple Wireshark Captures: Follow the Same Packet Across the Network Read More »

, ,

Turn Wireshark Columns into Calculated Network Analytics

Networking and Computing Tips and Tricks / By

Views: 577Most Wireshark users eventually discover Custom Columns. Instead of being limited to the standard Source, Destination, Protocol, Length, and Info columns, you can add useful fields such as: tcp.stream tcp.analysis.ack_rtt dns.qry.name vlan.id That alone can make packet analysis much easier. But in newer versions of Wireshark, Custom Columns can do much more than simply

Turn Wireshark Columns into Calculated Network Analytics Read More »

, , ,

The Wireshark # Operator: Filter the Inner vs. Outer IP Header

The CellStream Blog / By

Views: 1,113Most Wireshark filters assume there is only one IP header in a packet. For example: ip.src == 10.1.1.10 works perfectly well in ordinary traffic. But what happens when the packet contains more than one IP header? That is common with technologies such as: A tunneled packet might look like this structure: Now we have

The Wireshark # Operator: Filter the Inner vs. Outer IP Header Read More »

, , , , ,
Scroll to Top