Windows · Guide
How to Capture and Read Network Traffic with Wireshark on Windows
Short answer
Install Wireshark with Npcap, pick the network adapter carrying your traffic, start the capture, reproduce the problem, then stop and narrow the result with a display filter such as http or ip.addr==192.168.1.10.
Requirements
- Windows 11 or Windows 10
- Wireshark with the bundled Npcap driver
- Administrator rights for the first install
- A reproducible network problem to capture
Steps
1. Install Wireshark and Npcap
Run the official installer and keep Npcap selected — without that driver no adapters appear in the capture list. A reboot is sometimes required.
2. Pick the correct adapter
The welcome screen shows live traffic sparklines. Choose the interface that is actually moving data, not a virtual adapter created by a VPN or hypervisor.
3. Keep the capture short
Start the capture, reproduce the problem once, and stop. Thirty focused seconds is far easier to analyse than ten minutes of background noise.
4. Filter the display, not the capture
Type a display filter such as dns, tcp.port==443 or ip.addr==192.168.1.10 in the bar at the top. Capture filters discard data permanently; display filters keep it.
5. Follow a conversation
Right-click a packet and choose Follow > TCP Stream to see the exchange in order. This turns thousands of rows into one readable transcript.
6. Read the failure pattern
Repeated SYN with no SYN-ACK means nothing is listening or a firewall is dropping traffic. RST means an active refusal. DNS failures show as NXDOMAIN or unanswered queries.
7. Save and share the evidence
Save as pcapng and note the time and what you reproduced. Remember that captures may contain credentials and personal data, so treat the file as sensitive.
Alternative methods
1. Scan first, capture second
If the question is simply whether a service is reachable, Nmap answers it in seconds without any packet analysis.
2. Capture headlessly with tshark
tshark -i Ethernet -a duration:30 -w capture.pcapng records on a server with no GUI, and you can open the file on your workstation afterwards.
Troubleshooting
No interfaces are listed
Npcap is missing or its service is stopped. Reinstall Wireshark with Npcap selected and start Wireshark from an administrator account.
All traffic is TLS and unreadable
That is expected. Set the SSLKEYLOGFILE environment variable and point Wireshark at the key log file to decrypt browser traffic you own.
I only see my own PC's traffic
Switched networks only deliver your traffic to your port. Capturing other devices requires a mirror or SPAN port on the switch, which you must be authorised to configure.
Frequently asked questions
Is Wireshark legal to use?
Capturing traffic on networks and devices you own or administer is standard practice. Intercepting other people's traffic without authorisation is not.
Can Wireshark see passwords?
Only on unencrypted protocols. Modern HTTPS, SSH and email traffic is encrypted, which is why captures usually show metadata rather than content.
Does capturing slow the network?
Capturing is passive and does not add traffic, though very long captures generate large files and use disk quickly.
What is the difference between Wireshark and Nmap?
Nmap actively probes hosts to find open ports. Wireshark passively records the packets that already flow past your adapter.