In windows, the WinPcap driver (called NPF) is loaded by Wireshark when it starts to capture live data. To be secure (at least in a way), it is recommended that even an administrator should always run in an account with (limited) user privileges, and only start processes that really need the administrator privileges.Īlso Read: Live Packet Sniffing with Python Script The way this is done differs from operating system to operating system. Start the Wireshark – You need to run Wireshark on an account with sufficient privileges to capture, or need to give the account on which you’re running Wireshark sufficient privileges to capture. Let’s take a look at the basics of using Wireshark to capture and analyze traffic. It can decode different protocols that it sees, so you could, for instance, reconstruct the audio of Voice over IP (VoIP) phone calls.

Wireshark can be used to capture Ethernet, wireless, Bluetooth, and many other kinds of traffic.

Wireshark is a graphical network protocol analyzer that lets us take a deep dive into the individual packets moving around the network.

Wireshark http traffic only