Capturing packets using Wireshark

Wireshark is a very popular and well-known tool used for network and packet analysis and troubleshooting. It comes pre-installed in Kali and is relatively straightforward to use once you have an idea of filters, protocols, and color codes.

If you’re new to the Wireshark protocol analyzer and packet analysis, you can find some great tutorials online, including the official documentation at https://www.wireshark.org/docs/wsug_html_chunked/ChapterCapture.html.

First, let’s see what our network interfaces are and then begin using Wireshark:

1. We’ll need to specify our interface when capturing packets after starting Wireshark. To get information on your interfaces in Kali Linux, open a Terminal and type ifconfig:

Figure 16.1 – ifconfig output

In the preceding screen capture, the ifconfig command displays the output for two interfaces. The interface I’ll be using is my Ethernet...