Capture Basics

Start a Capture

Wireshark 4.x opens on the welcome screen, a list of interfaces with live sparklines. Double-click an interface to start, or pick one and press the shark fin. The toolbar shortcuts matter more than the menus.

Auto-scroll and colorizing are toggles with no default key, in the Go and View menus. View → Internals → Keyboard Shortcuts lists everything the build has.

On macOS the app is Wireshark.app and the CLI tools live in /Applications/Wireshark.app/Contents/MacOS/. Homebrew installs tshark, dumpcap, editcap, mergecap, and capinfos on PATH.

Interfaces and Permissions

Raw capture needs elevated privileges. The right fix is never running the GUI as root, it is giving the small dumpcap helper the capability.

# List what you can capture on
tshark -D
dumpcap -D -M              # machine-readable

# Linux: let your user capture without sudo (Debian/Ubuntu)
sudo dpkg-reconfigure wireshark-common   # answer "Yes"
sudo usermod -aG wireshark "$USER"       # then log out and back in

# Linux, manual equivalent
sudo setcap cap_net_raw,cap_net_admin=eip "$(which dumpcap)"

# macOS: the installer sets ChmodBPF, fix it with
open "/Applications/Wireshark.app/Contents/Resources/Extras/"

Pseudo-interfaces worth knowing:

Loopback traffic never crosses a NIC, so capturing on en0 or eth0 shows nothing for curl localhost. Use the loopback interface.

Capture Options (Ctrl+K)

The options dialog is where long captures are configured. Everything here has a dumpcap flag equivalent, which is what to reach for on a server.

# Headless long capture, 20 x 100 MB ring, rotate hourly too
sudo dumpcap -i eth0 -s 0 -B 64 -w /var/log/cap.pcapng \
  -b filesize:100000 -b files:20 -b duration:3600

Promiscuous Mode and Switches

Promiscuous mode makes your NIC accept frames it is not addressed to, but a switch still only forwards you your own traffic plus broadcast and multicast. Seeing someone else's packets needs help at the network layer.

- SPAN / port mirror, the switch copies a port or VLAN to your port. This is the normal answer in a managed network. - TAP, an inline hardware splitter. No configuration and no drops under load. - Hub, a genuine repeater floods every port. Real hubs are mostly gone. - On the host itself, capture on the machine that sends or receives. Always available and usually enough. - Wi-Fi monitor mode, the only way to see other stations, and it usually disconnects your own association while active.

Checking for drops matters as much as the filter. The status bar shows dropped counts, and capinfos reports them after the fact.

capinfos -c -d -a -e -y capture.pcapng   # counts, bytes, first/last, drops

Save, Split, and Merge

The GUI writes to a temp file until you save. File → Export Specified Packets writes only what the display filter shows, which is how a 4 GB capture becomes a 4 MB attachment.

# Slice a time window out of a big file
editcap -A "2026-09-15 10:00:00" -B "2026-09-15 10:05:00" big.pcapng cut.pcapng

# Split into 100k-packet chunks, or 60-second chunks
editcap -c 100000 big.pcapng part.pcapng
editcap -i 60 big.pcapng minute.pcapng

# Keep only packets matching a display filter
tshark -r big.pcapng -Y "tcp.port == 443" -w tls-only.pcapng

# Merge chronologically, then fix out-of-order timestamps
mergecap -w all.pcapng a.pcapng b.pcapng
reordercap all.pcapng sorted.pcapng

# Strip payload before sharing, keep headers only
editcap -s 96 big.pcapng headers.pcapng

A capture filter is destructive. Packets excluded by -f were never written and no display filter brings them back. When in doubt capture wide with a small snaplen and filter on display.