Wireshark’s own documentation specifies that capturing interfaces on a fully saturated 100 Mbit/s Ethernet will produce around 750 MB of data per minute – a rule of thumb worth remembering in relation to your own system’s specifications and available resources. It’s important to realize that Wireshark captures its information to memory, which may cause the program to hang if it’s run for a considerable length of time, or when overall system memory is low. Individual packets may be selected to get a drill down and deeper analysis of its contents. Wireshark produces a log, in which each individual line represents one packet that was exchanged. As you gain a clearer idea of the specific types of traffic you want to monitor, you can use the Filters feature to exclude certain types of traffic, or include specific kinds of packets. Once you’ve clicked Start, you’ll see network traffic movements in real time – and be able to stop Wireshark from running manually, if you haven’t configured an automatic stop.

Select the interface you want, then click Start. The Options menu enables you to specify the length of time that Wireshark should run for, or the amount of data it should capture before it stops. Once you’re clear on what you hope to achieve with the software, you can begin capturing network traffic by choosing Capture, then Options. You should use port mirroring, if you wish to examine traffic on an Ethernet port other than the one your Wireshark system is plugged into. If you just need to isolate and check up on local conditions, plugging the system on which Wireshark is installed into the relevant switch port will enable you take readings on the hardware addresses associated with that port, broadcast/multicast traffic, and traffic passing to and from the system between ports. To get the most out of this utility, you’ll need to plan ahead a little – mostly to determine what it is that you actually want to monitor. Wireshark is designed to capture and log the activity on your network in real time, so that you can sort through and analyze the results in your own time.

The setup program can be obtained from the Download section of the Wireshark website. If you haven’t done so already, the first thing you’ll need to do is install Wireshark on your testing system. Here are some tips and best practices, describing how. The utility provides a detailed report on the traffic flowing through your Network Interface Card (NIC), and may be used in benchmarking network performance and troubleshooting network issues.

Wireshark is distributed as a free open source packet analyzer.

What is wireshark and how does it work