Wireshark

Overview

Wireshark is the dominant packet analyzer. It decodes 3000+ protocols and is the reference for anything from "why is this API slow?" to "extract the exfiltrated ZIP from this PCAP." tshark is the CLI companion — use it in scripts, over SSH, or when the capture is too large for the GUI. Capture filters (BPF) trim traffic at capture time; display filters refine what you see afterward.

Instructions

Step 1: Capture Traffic

# List interfaces
tshark -D
# 1. eth0
# 2. wlan0
# 3. lo (Loopback)