See exactly what your computer is sending with Wireshark
Your laptop is talking to the internet all the time, and most of it you never see. Wireshark lets you watch it: every connection your apps open, every name they look up, every server they reach. In one short capture on your own machine you will read a real plaintext web request word for word, watch a name lookup turn github.com into an address, and list every host you talked to. You will also see, honestly, where the view stops: most traffic now is encrypted, so you learn to read the metadata (who, where, which service) rather than the contents. Free, open source, and entirely on your own machine and network.
- A terminal where you can capture packets. On Windows that means WSL2 (the slim Linux built into Windows); on Linux or a Mac it is your normal terminal. The hands-on uses
tshark, Wireshark's command-line twin, because a graphical window cannot be shown in a written lesson. The Wireshark desktop app is described alongside so you can do the same by clicking - Comfort installing a small package from your package manager. If
gitand basic terminal moves are new, do Install anything from GitHub in Level 0 first - About 100MB of free disk space for tshark and its libraries
- Optional but recommended: See which servers and countries your PC talks to shows the same idea on a live map. This mission goes one level deeper, to the packets themselves
The rules, and what a capture actually shows
Fix the one hard rule in your mind before you capture anything, and understand what a packet and a capture are.
Every time an app on your computer talks to the internet, it does not send one long stream. It breaks the message into small numbered pieces called packets, sends them separately, and the other end puts them back together. A packet carries a little header (who it is from, who it is going to, which service) and a chunk of the actual data. Watching the packets go past is the most honest view there is of what your machine is really doing on the network, because it is the traffic itself, not a summary an app chose to show you.
A capture is a recording of those packets as they cross one network interface, saved so you can read them at your own pace. Wireshark is the tool that records and reads them. You point it at an interface (your Wi-Fi or Ethernet adapter), it writes down every packet that passes, and then you filter and read. That is the whole idea. Everything else is detail.
CarefulOnly ever capture traffic on networks and devices you own, or that you have explicit, written permission to monitor. Capturing other people's traffic, on a shared office or cafe network, on someone else's machine, or on any network you were not given permission to monitor, can be a criminal offence in the UK (the Computer Misuse Act 1990, and interception law) and almost everywhere else, even if you never do anything with what you see. This mission stays entirely on your own computer, capturing your own machine's own traffic. Keep it there.There is a second, quieter limit that is not about law but about what is technically visible, and it is worth knowing before you are surprised by it. Most web traffic today is encrypted. You will still see which servers you connect to, which names you look up, and anything sent the old plaintext way, but you will not see inside an encrypted connection. Step 6 covers exactly where the line falls. The honest version of this skill is reading the metadata well, not expecting to read everyone's messages.
TipA good way to think about it: a capture shows you the outside of every envelope your computer sends (the addresses, the postmark, the size) and the full contents of any envelope that was sent unsealed. Sealed envelopes (encrypted connections) stay sealed. That is still a great deal of information.