Basics of Wireshark – Session 1 – Setting up your Wireshark Install

By Manny Fernandez

February 22, 2026

Basics of Wireshark – Session 1 – Setting up your Wireshark Install

I have always been interested in packet capture and packet level analasys. I remember using Novell’s LANalyzer and who could forget the Network General Sniffer with the V.35 Y-Connectors and their T-1 Y-Connector. I also used another packet capture while at Lucent but can’t remember the name, if anyone remembers, hit me up. Even Microsoft had one breifly Network Monitor. Then came Ethereal which then became Wireshark. They have changed the game.

This will be a multi-part post where I will cover different aspects of Wireshark and how to analyze packet captures. Its not a Wireshark expert course or masterclass, but if you are new to Wireshark, you will hopefully walk away with a better grsp for the app, and more importnly how to do some troubleshooting. I have already started on the Capture and Display filter which will be Session 2.

It remids me of a trip to Grand Cayman with a customer of mine that was having issues with their Cable and Wireless circuit. It was supposed to be a point-to-point circuit. I called and worked with their network team, no one was able to fix it. I told the customer I needed to rent (yes you could do that then), and they agreed. I went on site with the Sniffer and brught a Cisco Serial cable which had a connection to a V.35 CSU/DSU and I brought a new V.35 cable and Cisco router. We tested the circuit and found that every single packet was marked Discard Eligible which was strange cause it was not Frame-Relay or so we though. DE is normally seen in Frame-Relay. Turns out the circuit was in fact Frame-Relay. We changed the cable, serial card, and router and captured more packets. Long story, longer, the engineers that had come to the customers office to ostensably wreck me, left with their tails tucked after they accused me of having a bad cable….. which I then pulled out the same report with the new router, card and cable. Turns out, they were doing some policing on the circuit. The CO was about 15 min away; 20 minutes after leaving the office, the circuit was testing clean. I am sure there is a picture of me at Cable and Wireless Cayman where they throw darts at. After that, any issue, I would threaten them we coming down with my Sniffer. 😂.

Focus Manny……

Wireshark

Honestly, there is very little I do with Wireshark on my PC as far as capturing, unless I am troubleshooting something on my device or to it. Most of the time, I am anazlying captures from other devices such as FortiGate firewalls, PAN firewalls, TCPDumo from a linux box somewhere, etc.

Lets download Wireshark. Click on Downloads. As you all know, I am on a macOS platform but Wireshark runs on macOS, Windows, and Linux.

Choose your version of Wireshark and download it. I normally choose the defaults when installing them.

Additional Files on macOS

There are a few additional files when you mount the macOS .dmg file. These are:

Read me first.html
Donate to the Wireshark Foundation.html

Install ChmodBPF.pkg
Uninstall ChmodBPF.pkg

Add Wireshark to the system path.pkg
Remove Wireshark from the system path.pkg

ChmodBPF.pkg – This file will change the mode of the app. In short, it is a small configuration script that grants Wireshark the permissions it needs to capture live network traffic without requiring you to run the entire application as “root” (the superuser), which would be a major security risk. Conversely, the Uninstall will remove the modification to the applications.

Add Wireshark to the system path.pkg – While the ChmodBPF package handles permissions, the Add Wireshark to the system path.pkg is all about convenience and command-line access.

When you run this installer, it ensures that you can type wireshark, tshark, or other Wireshark utilities into your Terminal from any directory and have them launch instantly. And in this case, the Remove will remove it from the path.

I recommend you install both since we will use it in later sessions.

Configuration

Now that you have Wireshark installed lets get started. BTW, Wireshark has done a better job with the install where it does not require a restart which is helpful if you need to install it on a server during production.

Interfaces

When you launch Wireshark, it is going to show you all the interfaces it sees as possibly capturing interfaces. Sometime, like in my case, I have a bunch of interfaces I will NOT use, although I may use like in VPN tunnel-interfaces.

To modify in macOS type ⌘ K and on Windows and Linux CTRL K

There you will see the list of Interfaces on your device.

If you click the Manage Interfaces you will be able to see and select/deselect the interfaces.

Now hit OK.

Layout

What you see is as important as what you capture. So lets see the different ways you can display your information. In macOS, you can go to the application icon on the top left, and choose Preferences. Once there you can go to the layout button

Depending on the realestate of your display, you may want to rearange what you are looking at.

The Packet Diagram is an interesting option fairly new feature (~2020). If you choose that, It will show you the packet diagram in that paticulat packet

But, if you right click in the box and choose Show Field Values It will show the actual packet as it represents each section of diagram.

Settings

Get familiar with the settings. We will dive into them in other Sessions.

View Menu

Statistics Menu

In Wireshark, there is a concept of Profiles you can use these to have specific setting for particular things you are troublehsooting. You may have buttons, color filters etc.

On the bottom right of the Wireshark screen, you will see the profile you are current on.

You can quickly swap between them.

You can also go to the Edit menus and choose Configuration Profiles

Once in there, you can create new profiles.

You can see that (1) is showing the NEW PROFILE i just created. Note (2) and (3) that will allow you to export your profiles and import some as well.

Buttons

Start a new Capture
Stop the current capture.
Restart the current capture
Capture settings (e.g. interface, capture filters, etc.)

Open an existing capture (.pcap)
Save the current capture
Delete the current capture
Reload the current capture (when you make color changes)

Find a packet. This can be using a display filter, a Hex value, or a Regular Expression
Go to the previous packet.
Go to the next packet
Go to a specific packet number
Go to the first packet.
Go to the last packet.
Autoscroll to the last packet during a capture.

Toggle the colors on and off
Enlarge the main windows
Reduce the main window
Return the main windows to the default
Fit colums to information shown.
Go back to the window sizes originally set.

Check out my YouTube channel for the video version.

Basics of Wireshark – Session 1 – Setting up your Wireshark Install

Wireshark

Configuration

Interfaces

Layout

Settings

Buttons

Recent posts