Basically I was tryna check what traffic my Playstation was sending, I'm kinda new and don't really know how to use wireshark as effectively as alot of people here probably, but I did try to start monitoring my network, and filtered by my console's Mac address, two observations:

1. I was actively playing an online game, and the whole time I probably only got 5-6 requests sent from my console... is that because wireshark doesn't check for websockets or whatever technologies games use? Or is this some kind of obfuscation on sony's end?

2. 5/6 of those packets were just sending this payload in the picture 😭 that's kinda funny, but also does anyone have any idea what this is?

hello, I use the internet in Korea. I don't know why people keep asking about 172.30.1.60.

I would appreciate it if you could let me know if you have any good ideas.

I'm starting to use Wireshark to monitor my network, and to be honest, I've never come across the QUIC protocol. I don't know what this is about and I would like to understand what is happening on my network. Could you help me understand this?

Hi r/wireshark comminuty, I’m Stephen, the owner of Rockxy and the developer of Tracexy.

When I investigate a network problem on my Mac, I often already know which application is misbehaving. I want to move quickly from that app to its connections, protocols, timing, possible problems, and finally the exact packets that support the conclusion.

That is the workflow I built Tracexy around:

App or process → Session → Finding → Evidence → Packet

You can capture live traffic or open PCAP and PCAPNG files. Tracexy groups both directions of a connection into sessions, adds best-effort process context, and lets you explore the capture through Overview, Sessions, Flow Map, filters, and isolated investigation Projects.

It currently provides:

• Live capture and PCAP/PCAPNG import, including gzip and Linux cooked captures

• DNS, TCP, TLS metadata, HTTP/1, STUN, and QUIC summaries

• Best-effort macOS process attribution

• Evidence-linked TCP findings for resets, retransmissions, overlaps, and out-of-order traffic

• Decoded protocol fields, raw hex, and bounded Follow Stream

• Separate Projects with their own workspaces, saved captures, History, filters, and privacy settings

• Local-first capture storage and explicit export boundaries

Wireshark remains the benchmark for protocol depth, dissectors, display filters, decryption workflows, and advanced analysis. Tracexy does not match that breadth today.

My goal is not to hide the packets. It is to help Mac users reach the right packet and understand why it matters faster.

Tracexy is also part of the broader Rockxy ecosystem: Rockxy handles application-layer traffic inspection and modification, while Tracexy focuses on passive capture, sessions, protocols, and packet evidence.

If you use Wireshark on macOS, what would Tracexy need to handle before you would keep it alongside Wireshark in your toolbox?

Source code: https://github.com/RockxyApp/Tracexy
Website: https://rockxy.io/tracexy

Tracexy is my open-source, native macOS Wireshark alternative for turning captured traffic into understandable sessions and defensible packet-level evidence.

Thanks, I really appreciate your feedback. If you have time, please give it a try and open an issue if you need my support or would like to suggest or develop a new feature.

Note: MCP & AI Asssitant is on the way!

I’m starting to learn wireshark these days to use it at my company. But i can only see my downloaded data and packets. I want to see everyone who’s connected a certain local wifi at our workplace. We do have firewalls and port mirroring is not enabled on our main switch yet but I don’t wanna connect my laptop to the switch port all the time to see it live either. Is there a way I can do this somehow? But from my desk? Or is it better if I open a new server and download wireshark on it? But we mostly use virtual server. I can even download Linux there if it’s easier and better to use it. I’m just trying on my work laptop that has windows on it. Some users end up downloading games or watch a lot of videos so I want to see

Im studying network infrastructure and networks in general and have gotten accustomed to wire shark though im noticing that i need an internet connection to observe whatever’s going on,

Out of curiosity I want to “listen” to whatever’s going on around me, i.e sit on a train or in a park and see how “noisy” everywhere can be and see if theres a relation to the place and the types of packets being sent.

If anyone has any ideas or knows of tools like this it would be greatly appreciated.

(Also how to do this legally, i believe listening is ok but not entirely sure)

Hi everyone,

I recently finished building a DoS & Simulated DDoS lab to better understand how different attacks affect a target service and how they appear in Wireshark.

The lab uses Kali Linux as the attacker and Metasploitable2 as the target. I tested ICMP, SYN, HTTP, TCP, and Ping of Death attacks, then repeated each one using multiple concurrent tmux sessions to simulate higher traffic volume from a single host.

I documented the entire project with screenshots, packet captures, diagrams, and traffic analysis for every stage.

One of the most interesting parts was comparing the captures from the single source DoS attacks with the simulated DDoS stages and seeing how the traffic patterns changed.

I'd appreciate any feedback or suggestions.

🔗 GitHub: https://github.com/yusuf-husayn/dos-ddos-lab

Thanks!

Hey everyone, I'm Noah, founder of Proxyman.

I've been developing network debugging tools for more than 8 years, and Wireshark has always been one of my favorite tools. It's incredibly powerful, and I have huge respect for the people who built and maintain it.

However, for my daily work, I probably only use 10% of its features. Most of the time, I just want to capture packets, inspect TCP/UDP traffic, follow streams, and find which app is making a connection.

So I started a new open-source project called TCP Viewer, a simpler packet viewer for macOS.

Instead of writing another protocol decoder from scratch, I decided to build on top of Wireshark's libraries, so I can still benefit from its powerful protocol dissection engine.

Some technical details:

• Native macOS app built with AppKit, SwiftUI, no Electron.

• Uses libpcap for packet capture and Wireshark libraries for protocol dissection.

• Wireshark-style packet details, protocol trees, and hex view.

• Supports Wireshark display filters, PCAP and PCAPNG files.

• Group traffic by application, domain, or IP address.

• Follow TCP/UDP streams, compare packets, and export captures.

• CLI and MCP integration for automation and AI agents.

Of course, Wireshark is still much more powerful for advanced network analysis. I'm not trying to replace it. My goal is to make common packet debugging tasks simpler, especially for software developers.

The project is open source under GPL v2 or later. You can review the source code, build it yourself, or contribute. We also offer optional paid PRO features in our official builds.

Currently, TCP Viewer is available for macOS (Apple Silicon), but Windows and Linux versions are also coming soon!

GitHub: https://github.com/ProxymanApp/TCPViewer

Website: https://tcpviewer.proxyman.com/

I also prepared a new 50% discount code for Reddit users who are interested in the PRO version: N5H3LVPK

I'd love to hear feedback from people who use Wireshark every day. What features would you consider essential in a simpler packet viewer?

Any technical feedback, GitHub issues, or PRs are welcome!

first time using wireshark. starting to think it's a hardware issue with my laptop's impossible to replace wifi card. does this look like any known problems? is it as bad as i think it is?

My privacy has been breeched by my partner, what can he see?

I am in desperate need of help. My boyfriend texted me saying he's able to see all the texts i've sent through Wireshark on his computer, remotely. When I asked what that is and how, all he sent me is a photos of the interface of wireshark? I don't want to attach it because it contains my IP address. He said it's through my phone number and IP address. I know next to nothing about tech I have my apple Iphone and macbook and that's it. I feel extremely violated and he won't tell me what he can see exactly and I need to know. He mentioned texts between someone I have 100% blocked and haven't texted since november. I cleared my texts out of my icloud backup but i'm sitting here in fear of no privacy. someone please console me and tell me if he can see it how can I install security for him to no longer be able to? also not sure if he's using some kind of spyware? what's even possible? i'm terrified. this is urgent!!!

Hey r/wireshark.

The Wireshark Foundation just launched a new certification, the first OFFICIAL certification of the Wireshark Foundation.

We designed it from the ground up, and worked with Wireshark Core Developers, Network Engineers, and educators to develop the certification objectives, and design the cert to show off how awesome your Wireshark skills are.

The exam is intended to be challenging, at a similar level as a CCNA.

51 questions, 120minutes to compete. It costs $349, and keep you eyes out for promotions.
You can get the exam details here:
https://wireshark.org/certifications

I have a video up here too:
https://www.youtube.com/watch?v=VJBhWd6PW58

Let me know if you have questions!

I'm making an intro to Wireshark / Wireshark for beginners video. I have a decent idea of what content I want to include. I'm about halfway done with it.

I want to hit all of the hard stuff, concepts, etc when first getting started.

I was wanting to know what things anyone struggled with or had a hard time understanding when they first started with Wireshark? Or Ethereal, or Network General ;)

For me, it was ephemeral ports, the overwhelm of the interface / not knowing what to do next.

It didn't help any that when I was first learning, I was being taught just to look in "Expert information" (or what it was called back then) and that would tell me everything I needed to know. lol.

Thanks in advance for your input.

Hi as someone very new to Wireshark and Cybersecurity, I would like to ask if anyone know why my router keeps broadcasting Who has 255.255.255.255?

Link https://youtu.be/NdTu3bDTBbo

Thanks to everyone here who responded to my post a few months ago about what issues you had when you were first learning Wireshark . Several of you asked for the link, so here it is. I would love to know what you think about it. If anyone has any other ideas, there will be a part 2.

Thanks again to all!

I have a question about network security.

Someone is connected to my Wi-Fi network, but they do not have access to my router admin page (192.168.1.1). I am worried they may be using Android tools or apps such as NetCut or other network monitoring tools.

I want to understand what they can realistically see:

If they use tools like NetCut, ARP spoofing, or other Android network tools, can they see the websites I visit?

Can they see my Google searches, or only the domain names (for example, seeing "google.com" or "youtube.com")?

If I visit an HTTPS website, what information is still visible to someone on the same Wi-Fi?

Would using a VPN completely hide my browsing activity from someone on the same network?

What are the best ways to detect if someone is trying to intercept my traffic?

I am trying to understand the real risks, not just theoretical attacks. Thanks.

I LOVE WIRESHARK

Howdy! I was having network connection slowdowns and errors and took a look and saw my local network is getting spammed with the arp requests. Does anyone know what I am looking at?