Investigate Network Traffic with Wireshark

Capture and filter live packets to find what your machine is doing.

Introduction

30 Second Summary

Right now, your computer is having conversations you never asked it to have. Every second, it sends and receives tiny chunks of data to servers around the world, completely invisibly.

In this project, you will install Wireshark, the industry-standard network analysis tool, and use it to capture and investigate your own computer's live traffic. You will filter through hundreds of packets, read them layer by layer, and discover exactly who your machine is secretly talking to.

What You'll Build

You will watch your machine's hidden network activity scroll across your screen in real time, then use SOC analyst techniques to answer the core security question: who is this machine talking to, and what are they saying?

By the end of this project, you'll have:

A real-time view of every packet leaving and arriving at your machine, with each row showing the sender, receiver, and protocol at a glance.
The skill to filter thousands of packets down to exactly what matters. Whether that is DNS lookups, ICMP pings, or all traffic to a single suspicious IP address.
A completed investigation of your computer's hidden background connections, where you identified unknown IPs and tracked down who owns them.
Secret Mission: Open an unfamiliar PCAP file you have never seen before and investigate it cold, just like a SOC analyst receiving an alert.

Do I need any networking experience?

No. This project starts from scratch and guides you through every click. You just need a Windows PC with an internet connection.

Before We Start

Before we dive into packets, take a moment to think about what you are building and why it matters for your journey as a SOC analyst.

Install Wireshark

Every network investigation starts with a tool that can see the raw packets flowing across your network. Without this visibility, you have no way to know what your machine is doing behind your back.

Wireshark is the industry-standard packet capture tool used by SOC analysts worldwide. In this step, you will install Wireshark on your Windows machine and find your network identity.

In this step, get ready to:

Install Wireshark with Npcap for live packet capture.
Verify Wireshark can see your network interfaces.
Find your IP address and Default Gateway.

Download and install Wireshark

Wireshark needs a companion driver called Npcap to capture live traffic from your network card. The Windows installer bundles both together, so you only need one download.

Check if Wireshark is already on your machine. Press the Windows key and type Wireshark.
If you see it in the results, open it and click Help then About Wireshark to check your version number.

✔️ I see version 4.6.7

You already have the correct version installed. Close the About window and skip ahead to the next substep (Verify the installation).

ⓧ I see an older version

Your current version needs updating. The new installer will upgrade your existing installation automatically.

Go to https://www.wireshark.org/download.html in your browser.
Click the Windows x64 Installer link to download Wireshark-4.6.7-x64.exe.
Run the downloaded installer.
Accept the defaults for all options.
When prompted about Npcap, leave Install Npcap checked.
When prompted about USBPcap, leave it unchecked. Do NOT install USBPcap.
A separate Npcap Setup wizard will appear during installation. Click I Agree on the license, accept all defaults, and click Install.
Click Finish on the Npcap wizard, then Finish on the main Wireshark installer.

Why not USBPcap?

USBPcap is an experimental tool for capturing USB traffic. You do not need it for network traffic analysis, and it can cause driver conflicts on some machines.

ⓧ I don't have Wireshark

No problem. Let's install it from scratch.

Go to https://www.wireshark.org/download.html in your browser.
Click the Windows x64 Installer link to download Wireshark-4.6.7-x64.exe.
Run the downloaded installer.
Accept the defaults for all options.
When prompted about Npcap, leave Install Npcap checked. This is required for live packet capture.
When prompted about USBPcap, leave it unchecked. Do NOT install USBPcap.
A separate Npcap Setup wizard will appear during installation. Click I Agree on the license, accept all defaults, and click Install.
Click Finish on the Npcap wizard, then Finish on the main Wireshark installer.

Why not USBPcap?

USBPcap is an experimental tool for capturing USB traffic. You do not need it for network traffic analysis, and it can cause driver conflicts on some machines.

Verify the installation

With Wireshark installed, you need to confirm it can see your network interfaces. An interface is a connection point between your computer and a network.

Press the Windows key, type Wireshark, and press Enter to open it.

Before it loads, what do you expect to see on the main screen? Think about what a packet capture tool needs to know before it can start recording traffic.

You should see the Wireshark welcome screen listing your network interfaces (such as Ethernet, Wi-Fi, and Loopback). Active interfaces show a small sparkline graph of traffic activity next to them. At least one interface should have a moving sparkline.

What are those sparklines?

Each sparkline shows a miniature graph of packets flowing through that interface right now. A moving sparkline means that interface is actively carrying network traffic. This is the interface you will capture from later.

Don't see any interfaces?

If the interface list is empty, Npcap may not have installed correctly. Close Wireshark, re-run the Wireshark-4.6.7-x64.exe installer, and make sure Install Npcap is checked. Then reopen Wireshark.

If you still see no interfaces, try restarting your computer. Npcap registers a system driver that sometimes needs a reboot to activate.

help me troubleshoot why Wireshark shows no network interfaces on Windows

Find your IP address

Every device on a network has an IP address that identifies it. You need to know yours so you can recognise your own traffic in Wireshark later.

Open Command Prompt by pressing the Windows key, typing cmd, and pressing Enter.
Find your network identity by running this command:

ipconfig

Before you look at the output, what two pieces of information do you think will help you identify your machine's traffic in Wireshark?

Look for the section that matches your active connection (Wireless LAN adapter Wi-Fi or Ethernet adapter Ethernet).
Note your IPv4 Address (for example, 192.168.1.x or 10.0.0.x). This is your machine's identity on the local network.
Note your Default Gateway (for example, 192.168.1.1). This is your router's address.

What is the Default Gateway?

Your Default Gateway is the IP address of your router. Every packet that leaves your local network passes through this device first. You will use this address to filter traffic between your machine and your router in a later step.

Not sure which adapter to look at?

The ipconfig output may show several adapters. Look for the one that has an IPv4 Address in the 192.168.x.x or 10.0.0.x range. Adapters with no IPv4 Address listed (or showing Media disconnected) are inactive.

help me identify my active network adapter and IP address from ipconfig output

You now have Wireshark installed and you know your machine's network identity. Next up, you will start capturing live packets and see the actual data flowing across your network in real time.

Capture Your First Packets

In the previous step, you installed Wireshark and found your machine's IP address. Now it is time to see actual network traffic flowing in real time.

Every time your computer connects to the internet, it sends and receives tiny units of data called packets. Until you watch them move, protocols and IP addresses stay abstract. In this step, you will capture live packets, generate traffic you control, and save the results as a file you can investigate later.

In this step, get ready to:

Start a live packet capture on your active network interface.
Generate ICMP and DNS traffic using commands you control.
Save your capture as a file for future investigation.

Start a live capture

Wireshark can listen to any network interface on your machine and record every packet that passes through it. Your active interface is the one with the moving sparkline you identified during installation.

In Wireshark, double-click your active network interface (the one showing a moving sparkline, likely Ethernet or Wi-Fi).
Packets immediately start scrolling in the main window.

Let it run for about 5 seconds. You will see dozens or hundreds of coloured rows appear, each one representing a single packet travelling to or from your machine.

Notice the columns across the top of the packet list: No., Time, Source, Destination, Protocol, Length, and Info.

What do these columns mean?

Source is the IP address of whoever sent the packet.
Destination is the IP address of whoever receives the packet.
Protocol is the language the two machines are speaking (DNS, ICMP, TCP, and so on).
Info is a one-line summary of what the packet says.

Don't see packets scrolling?

Make sure you double-clicked the correct interface. The active interface has a moving sparkline on the welcome screen.
If you are on Wi-Fi but double-clicked Ethernet (or vice versa), close the empty capture with Capture then Stop, then File then Close, and double-click the other interface.
help me figure out why Wireshark is not capturing any packets

Generate traffic you can recognise

Right now, the packet list is a wall of unfamiliar traffic. To see cause and effect, you will generate two specific types of packets that you can spot in the flood.

Switch to your Command Prompt window (keep Wireshark capturing in the background).
Send 4 ping packets to Google's DNS server by running this command:

ping 8.8.8.8

What does this command do?

ping sends ICMP echo request packets to a target IP and waits for echo replies. It is the simplest way to check if a remote machine is reachable. You are sending 4 requests to 8.8.8.8, which is Google's public DNS server.

You should see 4 replies in your Command Prompt confirming that the server responded.

Next, ask your DNS server to look up a domain name by running:

nslookup example.com

What does nslookup do?

nslookup queries your configured DNS server and asks it to translate a domain name (like example.com) into an IP address. This generates DNS packets that you will be able to spot in Wireshark.

Switch back to Wireshark.
Look at the Protocol column. You should now see rows labelled ICMP (your pings) and DNS (your name lookup) mixed in with everything else.

Can't spot ICMP or DNS packets?

Scroll down to the most recent packets at the bottom of the list. Wireshark shows oldest packets at the top.
If you still cannot find them, check that the capture was running while you typed the commands. The blue shark fin icon in the toolbar should NOT be visible when a capture is active (it changes to a red square stop button).
help me find my ping and DNS packets in Wireshark

Stop and save the capture

You have generated the traffic you need. Now you will stop the capture and save it as a file you can re-open anytime.

In Wireshark, click the red square Stop button in the toolbar to end the capture.
Click File in the menu bar.
Click Save As.
Navigate to your Desktop.
Type my-first-capture.pcapng as the file name.
Click Save.

What is a pcapng file?

pcapng is Wireshark's default capture file format. It stores every packet's raw bytes along with timestamps and metadata. SOC analysts share .pcapng files when investigating security incidents.

Before you check the status bar, how many packets do you think you captured in those few seconds?

Look at the status bar at the bottom of the Wireshark window. It shows a Packets: count. You should see at least 50 packets captured.
Confirm your Desktop now contains the file my-first-capture.pcapng.

Fewer than 50 packets?

If you stopped the capture too quickly, start a new one (click the blue shark fin icon), wait 10 seconds while running the ping and nslookup commands again, then stop and re-save.
help me get more packets in my Wireshark capture

You now have your first packet capture file saved to your Desktop. The problem is clear: hundreds of packets, most of them irrelevant background noise. In the next step, you will learn how SOC analysts cut through this chaos using display filters.

Filter the Noise

You captured your first packets in the last step. The result was a wall of hundreds of coloured rows, with your ping and DNS packets buried somewhere in the flood.

A SOC analyst never reads every packet. They use display filters to instantly hide everything except the traffic that matters.

In this step, get ready to:

Isolate your ping traffic using the ICMP filter.
Find your DNS lookups using the DNS filter.
Investigate traffic to specific IP addresses.

Filter for ICMP (your ping traffic)

Your capture file contains hundreds of packets from all kinds of background activity. Somewhere in that noise are the 8 ping packets you generated with the ping 8.8.8.8 command.

Before you apply the filter, think about this: out of the hundreds of packets in your capture, how many do you expect to see after filtering for ICMP?

In the display filter bar at the top of Wireshark (the text input field below the toolbar), type icmp and press Enter.

The packet list instantly shrinks to just 8 rows. Every other packet disappears from view.

Look at the packet list. You should see 4 "Echo (ping) request" packets going TO 8.8.8.8 and 4 "Echo (ping) reply" packets coming back FROM 8.8.8.8.
Check the Source and Destination columns. Your IP address appears as the Source in the request packets, and 8.8.8.8 appears as the Destination.
In the reply packets, the roles flip. Google's server (8.8.8.8) is now the Source, and your IP is the Destination.

What just happened?

You just went from hundreds of overwhelming packets to exactly 8 relevant ones with a single word. This is a complete conversation: your machine asked "are you there?" four times, and Google replied "yes" four times.

The display filter hides packets from view but does not delete them from the capture file. Your original data is still intact.

Don't see 8 ICMP packets?

Make sure you opened my-first-capture.pcapng from your Desktop (File > Open) rather than starting a new live capture.

Check that the filter bar background turned green after you typed icmp. A red background means the filter has a typo.

If you see more than 8 ICMP packets, your capture may have included extra background ping traffic. Look specifically for packets with 8.8.8.8 in the Source or Destination columns.

help me troubleshoot why my ICMP filter is not showing my ping packets to 8.8.8.8

Filter for DNS (your domain lookups)

Your nslookup example.com command generated DNS traffic. Now you will filter to see only those packets and discover what domain your computer looked up.

Click the Clear button (the X icon) to the right of the display filter bar to remove the ICMP filter.
Type dns in the filter bar and press Enter.

Only DNS packets remain visible. Check the status bar at the bottom of the window. It shows how many packets are "Displayed" compared to the total captured.

Look at the Info column. You should see "Standard query A example.com" (your nslookup command asking for the IP address of example.com).
Find the corresponding "Standard query response" packet. The Info column shows the IP address that example.com resolves to.
Click on one of the DNS query packets. In the lower pane (Packet Details), expand Domain Name System (query) to see the full details: the query type (A means IPv4 address lookup), the domain name, and in the response, the answer IP address.

What does the DNS filter show you?

Every time your computer needs to reach a website or service, it first asks a DNS server "what is the IP address for this domain name?" This filter shows you every one of those questions and answers.

You may see more DNS packets than just your example.com lookup. Windows makes background DNS queries for update servers, telemetry endpoints, and other services. Those are real DNS activity from your machine.

Not seeing the example.com query?

Your nslookup command generates multiple DNS packets. Two are internal PTR lookups for the DNS server itself. Scroll through the DNS packets and look in the Info column for one that specifically mentions example.com.

help me find my DNS query for example.com in the Wireshark capture

Filter by IP address

Protocol filters like icmp and dns show all traffic of a single type. But sometimes a SOC analyst needs to see ALL traffic to or from a specific IP address, regardless of protocol.

Click Clear to remove the DNS filter.
Type ip.addr == 8.8.8.8 in the filter bar and press Enter.

This shows every packet exchanged between your machine and 8.8.8.8, no matter what protocol it uses. You should see your ICMP pings and possibly some DNS traffic (if your DNS server happens to be 8.8.8.8).

Why filter by IP address?

This is how SOC analysts investigate a suspicious IP. When a security alert says "this IP contacted your network," the analyst filters for that IP and reviews every single packet exchanged with it. Protocol does not matter at that point. They want the full picture.

Now try filtering for your router. Click Clear, then type ip.addr == followed by your Default Gateway IP (the one you noted from ipconfig earlier) and press Enter.
This shows all traffic between your machine and your router. You will likely see a large number of packets here since nearly all of your internet traffic passes through the gateway.

Before you move on, think about what would happen if you applied the dns filter one more time. How many displayed packets will you see compared to your total captured packets?

Click Clear, then type dns and press Enter one more time to confirm.

Check the status bar at the bottom. The "Displayed" count is a fraction of the total captured packets. The domain names your computer looked up are clearly visible in the Info column.

What are display filters?

Display filters are the single most important skill in Wireshark. They let you slice a capture file from any angle: by protocol (icmp, dns), by IP address (ip.addr == x.x.x.x), by port, by field value, and much more.

The filter bar turns green when your expression is valid and red when it contains a syntax error. Protocol and field names are always lowercase.

Filter bar turns red?

A red filter bar means your expression has a syntax error. Check for extra spaces, capital letters, or missing == operators. Display filter names are case-sensitive and almost always lowercase.

help me fix my Wireshark display filter syntax error

You just learned the SOC analyst's most essential skill: cutting through thousands of packets to find exactly what you need. Next up, you will dive inside a single packet and read it layer by layer.

Read a Packet Like a SOC Analyst

Filters show you which packets matter. But a SOC analyst also needs to read what is inside a packet.

Every packet has layers, like an envelope inside an envelope. Understanding these layers is how you determine what actually happened on the network. This is the skill that separates someone who uses Wireshark from someone who investigates with it.

In this step, get ready to:

Dissect a DNS packet layer by layer to see how data is wrapped in protocols.
Understand what ports are and memorise the common ones SOC analysts watch for.
Compare a DNS packet with an ICMP packet to see how different protocols produce different structures.

Dissect a DNS packet layer by layer

A single DNS packet contains multiple layers of information stacked on top of each other. Each layer was added by a different protocol as your data travelled from your application down through the network stack.

In the display filter bar at the top of Wireshark, type dns and press Enter so only DNS packets appear.
In the Packet List pane, click on any packet that says "Standard query" in the Info column.

The middle pane (Packet Details) now shows expandable sections. Each section is one layer of this packet.

Click the expand arrow next to Frame. This is metadata about the capture itself: when the packet was captured and how many bytes it contains.
Click the expand arrow next to Ethernet II. This is Layer 2. It shows the physical MAC addresses of your network card and your router.
Click the expand arrow next to Internet Protocol Version 4. This is Layer 3. Look for the Source field (your IP address) and the Destination field (your DNS server's IP address).
Click the expand arrow next to User Datagram Protocol. This is Layer 4. You will see port numbers here.
Click the expand arrow next to Domain Name System (query). This is Layer 7. It shows the actual DNS question your computer asked.

You should see the domain example.com in the query details, matching the nslookup command you ran earlier.

What are these layers?

Think of each layer as a new envelope wrapped around your data. Your DNS question ("what is the IP for example.com?") gets wrapped in a UDP envelope (with port numbers), which gets wrapped in an IP envelope (with IP addresses), which gets wrapped in an Ethernet envelope (with MAC addresses).

Wireshark peels these envelopes open for you so you can inspect every layer.

Understand ports

Ports tell the receiving computer which application should handle the incoming data. Without ports, your computer would not know whether a packet is meant for your web browser, your email client, or your DNS resolver.

With the same DNS packet still selected, look at the expanded User Datagram Protocol section.
Find the Destination Port field. It reads 53. Port 53 is the standard port for DNS. Every DNS query in the world goes to port 53.
Find the Source Port field. It is a random high number (something like 54321). This is your machine's temporary port for this specific conversation.

What common ports should a SOC analyst know?

Memorise these five. They appear constantly in security investigations:

53 = DNS (domain name lookups).
80 = HTTP (unencrypted web traffic).
443 = HTTPS (encrypted web traffic).
22 = SSH (secure remote access).
3389 = RDP (Remote Desktop Protocol).

If you see traffic on port 3389 going to an unknown external IP, that is a red flag worth investigating.

Compare with an ICMP packet

Different protocols produce different packet structures. Seeing this difference trains your eye to recognise what is normal for each protocol type.

Clear the display filter bar and type icmp, then press Enter.
Click on one of the "Echo (ping) request" packets in the Packet List.
Look at the Packet Details pane. Expand the layers just like you did with the DNS packet.

Notice the difference. There is no "User Datagram Protocol" section. Instead, you see "Internet Control Message Protocol" directly after the IP layer.

Why does ICMP have no ports?

ICMP does not use ports because it is not carrying application data. It is a network-level utility protocol used for diagnostics (like ping). A SOC analyst recognises that each protocol has its own expected structure. Seeing TCP fields inside an ICMP packet would be abnormal and worth investigating.

Before you verify your new skills, predict: if you click on any DNS packet, how many expandable layers do you expect to see in the Packet Details pane?

Switch the display filter back to dns and press Enter.
Click on any DNS query packet and count the expandable sections in the Packet Details pane.

You should see five sections: Frame (metadata), Ethernet II (Layer 2), Internet Protocol Version 4 (Layer 3), User Datagram Protocol (Layer 4), and Domain Name System (Layer 7). You can now name the source IP, destination IP, source port, destination port, and protocol for any packet you click on.

Only seeing 3 or 4 layers?

Make sure you selected a packet with "Standard query" in the Info column. Response packets may show additional sections. If you accidentally clicked a non-DNS packet, check that your dns filter is still active in the green filter bar.

help me understand why my DNS packet shows fewer layers than expected

You can now peel open any packet and read its layers like a SOC analyst. Next up, you will put these skills to work investigating what your own computer is doing on the network behind your back.

Investigate Your Own Machine

In the previous step, you learned to read individual packets layer by layer. You can now name the source IP, destination port, and protocol for any packet you click on.

A SOC analyst does not just read individual packets, though. They ask questions and use Wireshark to answer them. The question for this step is: "What is my computer doing on the network that I did not ask it to do?" Every Windows machine makes background connections for updates, telemetry, and cloud sync. Finding and identifying these is your first real investigation.

In this step, get ready to:

Capture 60 seconds of background traffic with no user activity.
Use Statistics > Conversations to find every external IP your computer contacted.
Identify who owns those IPs using a whois lookup.

Capture fresh background traffic

Your previous capture contained traffic you intentionally generated (pings and DNS lookups). To see what your computer does on its own, you need a clean capture with no user activity.

Confirm all browser windows and applications are still closed (keep only Wireshark and Command Prompt open).
In Wireshark, click Capture in the menu bar.
Click Start to begin a new capture on your active interface.
You can also click the blue shark fin icon in the toolbar to start the capture.
If Wireshark asks whether to save the current capture, click Continue without Saving (you already saved your first capture earlier).
Wait 60 seconds without touching anything. Do not open any apps, browse any websites, or type any commands. Your computer is still sending and receiving packets.
After 60 seconds, click the red square Stop button in the toolbar to end the capture.

Check the status bar at the bottom of Wireshark. You should see a packet count showing dozens or even hundreds of packets captured. Every one of those packets was sent or received without you doing anything.

Why is my computer sending packets when I am not doing anything?

Windows constantly communicates in the background. It checks for software updates, sends telemetry data to Microsoft, syncs time with NTP servers, and checks certificate revocation lists.

Your antivirus also phones home for signature updates. A SOC analyst needs to know what is normal so they can spot what is not.

Find the hidden connections

Scrolling through hundreds of individual packets is not how a SOC analyst works. Wireshark's Conversations view summarises all traffic into a clean list of who talked to whom.

Click Statistics in the menu bar.
Click Conversations.
In the Conversations window that opens, click the IPv4 tab.

Before you look at the results, take a guess. How many external IP addresses do you think your idle computer contacted in 60 seconds?

Now look at the list. You should see multiple rows, each showing a pair of IP addresses (Address A and Address B) along with how many packets and bytes were exchanged. One of the addresses in each row is your own IP. The other is an external server your computer reached out to.

Look at the Address B column. Identify 3-5 external IP addresses that are NOT your local IP and NOT your Default Gateway.
Note these IP addresses down. These are connections your computer made without you doing anything.

How do I tell which IPs are external?

Your local IP (from ipconfig earlier) and your Default Gateway are internal addresses on your home network. Any IP address that does NOT start with the same prefix as yours (e.g., 192.168.1.x or 10.0.0.x) is likely external.

Also ignore broadcast addresses like 255.255.255.255 and multicast addresses starting with 224.x.x.x. These are local network management traffic, not external connections.

Identify what those connections are

You have found external IPs your computer is secretly talking to. Now you need to answer the SOC analyst's follow-up question: who owns those IPs?

Pick one external IP address from the Conversations list.
Right-click that row in the Conversations window.
Select Apply as Filter, then Selected, then A<->B.

The main Wireshark window now shows only the traffic between your machine and that specific IP. Look at the Protocol column and Info column for clues about what this connection was doing.

Open your web browser.
Search for "whois" followed by the external IP address you selected (for example, search "whois 52.178.150.100" using whatever IP you noted).
The whois result tells you the organisation that owns the IP. You will likely see names like Microsoft, Akamai, Google, Amazon, or your antivirus vendor.
Repeat for at least one more external IP from your list.

What will I typically find?

Common background connections on Windows include Microsoft telemetry servers, Windows Update endpoints, certificate revocation checks (OCSP), time synchronisation (NTP), and antivirus signature updates. Seeing these in your capture is normal.

A SOC analyst's job is to know what normal looks like so they can spot the abnormal. If a machine is connecting to an IP in an unexpected country or to a known malicious server, that is an alert worth investigating.

Not seeing any external IPs in the Conversations window?

Make sure you selected the IPv4 tab (not Ethernet or TCP). The IPv4 tab shows all IP-level conversations regardless of protocol.

If you see very few entries, your capture may have been too short. Try starting a new capture and waiting a full 60 seconds. Some background processes only phone home every 30-60 seconds.

Why am I not seeing external IPs in my Conversations window?

You have just completed your first network investigation. You found unknown connections, isolated them with a filter, and identified who your machine was talking to. This is the exact workflow SOC analysts follow every day: capture, filter, investigate, identify.

Your investigation skills are ready. Next up, you will take on the Secret Mission and investigate a PCAP file you have never seen before.

Secret mission

Investigate a Suspicious PCAP

Real SOC analysts rarely capture their own traffic. They receive PCAP files from security tools and must investigate them cold. Can you open an unfamiliar capture file and figure out what happened using only your filtering and investigation skills?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally using free and open source software, so there are no ongoing costs.

Resources you used:

Wireshark 4.6.7 (installed software).
Npcap (network capture driver, installed alongside Wireshark).
my-first-capture.pcapng (packet capture file saved on your Desktop).
dhcp.pcap (sample PCAP downloaded from Wireshark's SampleCaptures page).

Keep everything running

No action needed. Choose this if you plan to continue learning network analysis or want Wireshark available for future projects.

Wireshark is free and open source. It costs nothing to keep installed and is useful for ongoing security learning.
Your capture files are small (a few MB at most) and serve as handy references if you want to revisit your filters and investigation notes later.

Pause - I'll come back to this later

Close Wireshark to free up memory. Your installed software and saved files stay on your machine for next time.

Close any open Wireshark windows.
Your capture files (my-first-capture.pcapng and dhcp.pcap) remain on your machine. You can reopen them in Wireshark any time via File > Open.

Delete - I don't want to use this again

Remove all project resources and start fresh. This uninstalls Wireshark, Npcap, and deletes your capture files.

Close Wireshark if it is still open.
Open Settings by pressing the Windows key and searching for "Settings".
Select Apps, then Installed apps.
Search for Wireshark. Click the three-dot menu next to it and select Uninstall. Follow the prompts to remove it.
Search for Npcap in the same list. Click the three-dot menu and select Uninstall to remove the capture driver.
Delete your capture files by opening Command Prompt and running:

del "%USERPROFILE%\Desktop\my-first-capture.pcapng"

Delete the sample PCAP file from wherever you saved it. If it is on your Desktop, run:

del "%USERPROFILE%\Desktop\dhcp.pcap"

Confirm the files are gone by running:

dir "%USERPROFILE%\Desktop\*.pcap*"

You should see "File Not Found" confirming both capture files have been removed.

Nice Work!

You just completed your first network investigation using the same tool and workflow that SOC analysts rely on every day. You captured live packets, dissected them layer by layer, and answered the core analyst question: who is this machine talking to, and what are they saying?

You've learned how to:

Captured live network traffic with Wireshark and used display filters to isolate specific protocols (ICMP, DNS) and IP addresses from hundreds of packets.
Read packet details layer by layer, identifying source and destination IPs, ports, and protocols like a SOC analyst examining evidence.
Investigated your computer's hidden background connections using Statistics > Conversations, identified external IPs, and determined who owns them with whois lookups.
Secret Mission: Opened an unfamiliar PCAP file and investigated it cold using Statistics > Protocol Hierarchy and display filters.

Ready to quiz yourself?