Seeing It Live — Wireshark
Watch the theory of this course happen on a real wire
Everything in this course is invisible — until you capture it. Wireshark is a free tool that records real packets and lets you inspect every layer. This closing chapter shows what you would see, turning abstract concepts into things you can watch happen.
What is Wireshark?
Wireshark is a packet analyzer: it captures the frames flowing through your network interface and decodes them into human-readable detail. It is the single best way to actually see the protocols you have learned — DNS, TCP, TLS, HTTP — in action.
One packet, all the layers
Click any packet and Wireshark expands it layer by layer — the Ethernet frame (with MAC addresses), the IP header (with IPs and TTL), the TCP header (ports, sequence numbers, flags), and the application data (like HTTP). It is the encapsulation from Chapter 1, laid out in front of you.
Spotting the 3-way handshake
Open any TCP connection and the first three packets are unmistakable: SYN, then SYN, ACK, then ACK. You can read the sequence and acknowledgement numbers changing exactly as Chapter 16 described. Theory becomes observation.
A DNS query over UDP
Filter for DNS and you will see a tiny pair of packets: a "Standard query A example.com" and the "Standard query response" carrying the IP — sent over UDP on port 53, just as we covered. It is a perfect, minimal example of a request and reply.
Display filters cut the noise
A live capture is overwhelming, so Wireshark’s display filters narrow it down. Type dns to see only DNS, tcp.port == 443 for HTTPS, or ip.addr == 10.0.0.1 to follow one host. Filtering is the skill that turns noise into insight.
Why capture traffic?
Beyond learning, packet capture is a real debugging superpower: you can see retransmissions behind a slow request, confirm a TLS handshake succeeded, or prove where a connection breaks. Once you can watch the network, nothing about it stays mysterious.
You made it: From a single fetch() down to bits on the wire, and back up through TCP, DNS, HTTP and TLS — you now have the full mental model of how the internet moves your data.