Tools & Commands · Ethical Hacking Tools
Wireshark
Packet analysis · Beginner
A graphical packet analyzer that captures traffic on an interface you are allowed to monitor and lets you inspect the decoded protocols.
It turns a stream of frames into a readable conversation. Support staff use it to see whether a request left the computer and what came back. Capture only traffic you are permitted to see.
Example: A display filter for TCP port 443 shows a protected web handshake. You can see that the handshake happened without being able to read the encrypted page.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Capture and visually inspect packets and protocol fields.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Windows, Linux, and macOS.
Language you will see
- capture filter
- display filter
- packet list
- protocol decode
How to read the options
- Display filter: Hides rows after capture so you can focus on one port, address, or protocol.
- Protocol decode: Labels fields such as ports and flags instead of leaving you with only raw bytes.
What a handshake line is telling you
TCP 203.0.113.10 → 203.0.113.20 SYN TCP 203.0.113.20 → 203.0.113.10 SYN, ACK TCP 203.0.113.10 → 203.0.113.20 ACK
These three rows are a reliable connection starting. They do not show the later application request, and they do not reveal encrypted contents.
Common misconception
- A capture of encrypted traffic does not automatically reveal the hidden contents. It often shows only the endpoints, timing, and handshake.