WireShark.Com is not affiliated with Ethereal Wireshark

How to Capture Packets in Wireshark (Step-by-Step)

Learn how to start a packet capture in Wireshark, choose the right interface, and save your capture file. This guide also covers the most common reasons Wireshark won’t capture packets (Npcap, permissions, and interface issues).

Start Capturing Download & Install Guide

What Does Capturing Packets in Wireshark Mean?

Capturing packets means recording live network traffic as it travels between devices. Every website you visit, file you download, or app you use sends small units of data called packets.

Wireshark listens on a network interface (Wi-Fi, Ethernet, or VPN) and displays those packets in real time so you can inspect IP addresses, ports, protocols, errors, and performance issues.

Packet capture is commonly used for:

  • Troubleshooting slow connections
  • Investigating dropped packets
  • Analyzing DNS or HTTP traffic
  • Detecting suspicious network activity
  • Understanding how applications communicate

Before starting a capture, make sure Wireshark is properly installed. If you haven’t installed it yet, follow the Wireshark Download & Install Guide.

Before You Start Capturing Packets

Before starting a packet capture in Wireshark, you need to confirm that your system is properly configured. Most capture issues happen because of missing drivers or incorrect permissions.

1. Install the Correct Capture Driver (Windows Users)

On Windows, Wireshark requires Npcap to capture network traffic. Without it, Wireshark will open but no packets will appear.

If you’re unsure whether Npcap is installed, review our WinPcap vs Npcap comparison guide or download the latest version directly from the official Npcap website.

2. Run Wireshark with Proper Permissions

In many environments, packet capture requires administrator privileges. If you see no traffic flowing, try running Wireshark as an administrator.

On macOS and Linux systems, you may need proper group permissions to access network interfaces. The official Wireshark documentation provides system-specific instructions.

3. Confirm You Are on an Active Network

If your computer is not actively sending or receiving traffic, Wireshark may appear “empty.” Open a website or run a simple DNS lookup to generate traffic while capturing.

If you're still not seeing packets, review our Troubleshoot Packet Analyzer Guide for step-by-step fixes.

How to Choose the Correct Network Interface in Wireshark

Before starting a packet capture in Wireshark, you need to confirm that your system is properly configured. Most capture issues happen because of missing drivers or incorrect permissions.

1. Install the Correct Capture Driver (Windows Users)

On Windows, Wireshark requires Npcap to capture network traffic. Without it, Wireshark will open but no packets will appear.

If you’re unsure whether Npcap is installed, review our WinPcap vs Npcap comparison guide or download the latest version directly from the official Npcap website.

2. Run Wireshark with Proper Permissions

In many environments, packet capture requires administrator privileges. If you see no traffic flowing, try running Wireshark as an administrator.

On macOS and Linux systems, you may need proper group permissions to access network interfaces. The official Wireshark documentation provides system-specific instructions.

3. Confirm You Are on an Active Network

If your computer is not actively sending or receiving traffic, Wireshark may appear “empty.” Open a website or run a simple DNS lookup to generate traffic while capturing.

If you're still not seeing packets, review our Troubleshoot Packet Analyzer Guide for step-by-step fixes.

How to Start and Stop a Packet Capture in Wireshark

Once you’ve selected the correct network interface, starting a packet capture in Wireshark is simple.

Step 1: Start the Capture

Double-click the active interface (Wi-Fi or Ethernet), or select it and click the blue shark fin icon in the toolbar. Wireshark will immediately begin displaying packets in real time.

You should see rows of packets appearing with details such as:

  • Time stamp
  • Source IP address
  • Destination IP address
  • Protocol (TCP, UDP, DNS, HTTP, TLS)
  • Packet length

If no packets appear, generate traffic by opening a website or refreshing a page. If you're still not seeing activity, revisit the packet capture troubleshooting guide.

Step 2: Stop the Capture

When you’ve collected enough data, click the red square “Stop” button in the toolbar. This pauses the live capture but keeps all captured packets visible for analysis.

At this point, you can begin filtering traffic using display filters to isolate specific protocols or IP addresses.

How to Save and Export a Capture File

How to Save and Export a Capture File (.pcapng)

After stopping a packet capture, you’ll usually want to save the file for later analysis or to share with a colleague. Wireshark saves capture files in the .pcapng format by default.

Saving capture files helps you troubleshoot issues later, compare “before vs after” changes, and send a clean subset of traffic to a network or security team.

Save the Entire Capture

To save your capture:

  1. Click File → Save As
  2. Choose a file name and location
  3. Leave the format as pcapng
  4. Click Save

Tip: Use a descriptive name like dns-timeout-test.pcapng or vpn-drop-02-26.pcapng so you can find it quickly later.

Export Selected Packets Only

If you only need part of the capture, apply a display filter first, then go to File → Export Specified Packets.

  • Use this when you want to share only the relevant traffic (smaller file).
  • Helpful for isolating DNS failures, TLS handshakes, or TCP retransmissions.

Once saved, you can reopen the file anytime in Wireshark to continue analyzing traffic using techniques from our network traffic analysis guide.

How to Save and Export a Capture File

How to Save and Export a Capture File (.pcapng)

After stopping a packet capture, you’ll usually want to save the file for later analysis or to share with a colleague. Wireshark saves capture files in the .pcapng format by default.

Saving capture files helps you troubleshoot issues later, compare “before vs after” changes, and send a clean subset of traffic to a network or security team.

Save the Entire Capture

To save your capture:

  1. Click File → Save As
  2. Choose a file name and location
  3. Leave the format as pcapng
  4. Click Save

Tip: Use a descriptive name like dns-timeout-test.pcapng or vpn-drop-02-26.pcapng so you can find it quickly later.

Export Selected Packets Only

If you only need part of the capture, apply a display filter first, then go to File → Export Specified Packets.

  • Use this when you want to share only the relevant traffic (smaller file).
  • Helpful for isolating DNS failures, TLS handshakes, or TCP retransmissions.

Once saved, you can reopen the file anytime in Wireshark to continue analyzing traffic using techniques from our network traffic analysis guide.

Why Wireshark Is Not Capturing Packets (Common Fixes)

Why Wireshark Is Not Capturing Packets

If Wireshark is running but no packets appear, the issue is usually related to drivers, permissions, or selecting the wrong network interface. Below are the most common causes and how to fix them.

1. Npcap Is Not Installed (Windows)

On Windows systems, Wireshark requires Npcap to capture traffic. If it’s missing or outdated, no packets will appear.

Download the latest version from the official Npcap website, or review our WinPcap vs Npcap guide to understand the difference.

2. Wrong Network Interface Selected

Make sure you selected the active adapter (Wi-Fi or Ethernet). Look for the interface with the moving activity graph. If unsure, revisit the interface selection section above.

3. Not Running with Proper Permissions

In some environments, packet capture requires administrator privileges. Try closing Wireshark and reopening it as an administrator. On macOS and Linux, ensure your user has permission to access capture devices.

4. No Traffic Being Generated

If your system is idle, there may be no packets to capture. Open a website or perform a DNS lookup to generate traffic. Then apply a display filter like dns or tcp to confirm packets are flowing.

5. VPN or Firewall Interference

Some VPN clients and security software can interfere with packet capture. Try temporarily disabling the VPN or selecting the VPN adapter directly.

For deeper troubleshooting techniques, see our Packet Analyzer Troubleshooting Guide.

Frequently Asked Questions About Packet Capture Using Wireshark

Why is Wireshark not capturing any packets?

The most common causes are missing capture drivers (Npcap on Windows), selecting the wrong network interface, or not running Wireshark with administrator privileges. Make sure the correct adapter is selected and that traffic is actively being generated.

Do I need Npcap to capture packets in Wireshark?

Yes, Windows users must install Npcap for packet capture to work properly. Without it, Wireshark will open but no packets will appear. You can download it from the official Npcap website or review our WinPcap vs Npcap guide.

How do I choose the correct interface in Wireshark?

Select the adapter showing live traffic activity (moving graph line). Use Wi-Fi if connected wirelessly, Ethernet if plugged in, or the VPN adapter if traffic is routed through a VPN.

How long should I capture packets?

Short captures are easier to analyze. In most troubleshooting cases, 30 to 120 seconds of traffic is enough to identify DNS issues, TCP retransmissions, or application delays.

What file format does Wireshark use to save captures?

Wireshark saves capture files in the .pcapng format by default. This format preserves detailed packet metadata and can be reopened later for further analysis.

Can Wireshark capture encrypted HTTPS traffic?

Wireshark can capture encrypted HTTPS packets, but it cannot decrypt them unless you configure TLS decryption with the appropriate session keys. However, you can still analyze connection behavior, timing, and handshake information.

WireShark.Com

is not affiliated with Ethereal Wireshark

We provide independent educational content about packet sniffers, network traffic analysis, and troubleshooting techniques. Our goal is to help learners and professionals understand packet behavior and diagnose real-world network issues.

Packet Analysis Basics

Troubleshooting Guides

  • How to Choose a Packet Analyzer
  • How to Troubleshoot Packet Loss
  • How to Interpret Packet Headers
  • How to Detect Suspicious Traffic

Common Packet Capture Tools

Copyright 2025 WireShark.Com. All rights reserved. All information on this website is free of charge and is given without warranty.

Scroll to Top