What is Wireshark?
Learn what Wireshark is, how packet capture and display filters work, and when to use it — with networking interview Q&A.
Expected Interview Answer
Wireshark is a free, open-source network protocol analyzer that captures traffic passing through a network interface and lets an engineer inspect every packet in detail, decoded field by field down through the protocol stack.
Wireshark uses a packet capture library (libpcap/WinPcap/Npcap) to place a network interface into a mode where it can see traffic, then decodes each frame’s Ethernet, IP, transport, and application-layer headers into a readable, expandable tree. Its display filter language (e.g., "http.request", "tcp.port == 443", "ip.addr == 10.0.0.5") lets an engineer narrow thousands of captured packets down to exactly the conversation under investigation, while "Follow TCP Stream" reassembles an entire exchange into one readable view. It is commonly used to diagnose slow or failing connections, verify that a handshake or DNS query behaves as expected, inspect malformed packets, and analyze security incidents such as suspicious traffic patterns. Because it can capture cleartext content, Wireshark is typically used on traffic the engineer is authorized to inspect, and encrypted traffic (like TLS) only reveals its payload if session keys are supplied separately.
- Captures and decodes live traffic packet by packet
- Powerful display filters isolate exactly the conversation of interest
- Reassembles full TCP streams for end-to-end readability
- Essential for diagnosing connectivity, performance, and security issues
AI Mentor Explanation
Wireshark is like a slow-motion, ball-by-ball replay system that lets an analyst rewind every delivery of a match and inspect the seam position, speed, and trajectory frame by frame, rather than just watching the game live. A commentator can filter the replay to show only deliveries bowled by one bowler, similar to a Wireshark display filter narrowing packets to one conversation. Replaying an entire over end to end mirrors "Follow TCP Stream" reassembling a full exchange. This deep, filterable replay of every event is exactly what Wireshark gives an engineer for network traffic.
Step-by-Step Explanation
Step 1
Start a capture
Select a network interface and Wireshark begins capturing raw frames via libpcap/Npcap.
Step 2
Decode packets
Each captured frame is decoded into its Ethernet, IP, transport, and application-layer fields.
Step 3
Apply a filter
A display filter (e.g., "tcp.port == 443") narrows the view to the conversation under investigation.
Step 4
Reassemble and analyze
Use "Follow TCP Stream" to view a full exchange end to end and diagnose the issue.
What Interviewer Expects
- Explains Wireshark captures and decodes traffic at the packet level
- Can describe writing and using a display filter
- Mentions Follow TCP Stream or a similar reassembly feature
- Aware of appropriate/authorized use given it can expose cleartext data
Common Mistakes
- Confusing Wireshark (packet analyzer) with a load-testing or scanning tool
- Assuming Wireshark can decrypt TLS traffic without session keys
- Not knowing display filters differ from capture filters
- Capturing traffic without authorization on a network not owned by the user
Best Answer (HR Friendly)
“Wireshark is a tool that captures network traffic in real time and lets you inspect every packet in detail — like opening up an envelope to read exactly what is inside instead of just seeing that mail was delivered. I use it to diagnose tricky connectivity or performance issues where I need to see exactly what is being sent and received, byte by byte, rather than guessing from application logs alone.”
Code Example
# Capture packets on interface eth0, filtered to HTTP traffic
sudo tshark -i eth0 -f "tcp port 80" -c 50
# Read a saved capture file and show only DNS queries
tshark -r capture.pcap -Y "dns"
# Example Wireshark display filter (used in the GUI filter bar)
# tcp.port == 443 && ip.addr == 10.0.0.5Follow-up Questions
- What is the difference between a capture filter and a display filter?
- How would you use Wireshark to diagnose a slow API response?
- Can Wireshark decrypt HTTPS traffic, and under what conditions?
- What is the difference between Wireshark and tcpdump?
MCQ Practice
1. What does Wireshark primarily do?
Wireshark captures live network traffic and decodes each packet field by field for analysis.
2. What Wireshark feature reassembles an entire TCP exchange into one readable view?
"Follow TCP Stream" reconstructs the full back-and-forth of a TCP conversation for easy reading.
3. What underlying library does Wireshark rely on to capture packets?
Wireshark uses libpcap (or Npcap on Windows) to place an interface into capture mode and read raw frames.
Flash Cards
What is Wireshark? — An open-source network protocol analyzer that captures and decodes packets in detail.
What is a display filter used for? — Narrowing captured packets down to a specific conversation or protocol.
What does Follow TCP Stream do? — Reassembles a full TCP exchange into one readable, ordered view.
Can Wireshark read encrypted TLS payloads? — Only if session keys are supplied separately; otherwise the payload stays encrypted.