The Exploit HQ

Wireshark for Beginners · lesson 1 · 2026-09-21

Wireshark Packet Sniffing for Absolute Beginners — Catching a Plaintext Login

Before you start

Watch the terminal. In a few seconds you’re going to watch a username and password cross the network in plain, readable text, caught live with nothing but a free tool called Wireshark.

This is a real capture, running right now, against our own local practice website. Let’s watch it happen.

tshark -i lo -f "tcp port 8080" -w capture.pcapng -a duration:5

Now we read that capture back and ask it one question: show me any password that was typed in.

tshark -r capture.pcapng -Y 'http.request.method=="POST"' -V

There it is. username equals admin, password equals password, sitting right there in the open. No hacking, no cracking, no guessing — we just listened.

That’s the whole payoff of today’s lesson. Now let’s restart from absolute zero and build up to that, one step at a time, so you understand exactly what just happened and can do it yourself.

You need zero experience for this. We’ll explain every word as we go.

First, the big question. What is packet sniffing?

What is packet sniffing?

When your computer talks to a website, the conversation is broken into small chunks called packets, a bit like tearing a letter into postcards and mailing each one separately. Each packet has a header, which is like the address on the envelope, and a payload, which is the actual message inside. Sniffing simply means sitting on the network and reading those postcards as they go past. Wireshark is the tool most people use to do that, and it comes in two forms: a graphical window, and a command-line version called tshark, which is what we’ll type today, because this is a terminal tutorial.

But how can you even see someone else’s postcards? That’s where promiscuous mode comes in.

Promiscuous mode

Normally, your network card is polite. It only picks up packets addressed to your own computer and throws the rest away unread. Promiscuous mode is a setting that tells the card, stop being polite, hand me everything you see, addressed to me or not. On a lot of modern networks that still won’t show you a stranger’s traffic, because switches are smart enough to only deliver packets to the right port. But there’s one kind of traffic that is always visible to you: your own computer’s traffic. Today we’ll sniff our own machine talking to a website running on that same machine, so nothing about switches or Wi-Fi can get in the way while you’re learning the basics.

Before we capture anything, a network needs somewhere to listen. That’s called an interface.

Step 1 — see what we can listen on

tshark -D
Part What it does
tshark Wireshark’s command-line tool — same capture engine, no window
-D list every network interface this computer can capture on

An interface is just a network doorway your computer has. It might be a Wi-Fi card, a wired Ethernet port, or, like today, the loopback interface, usually called l-o, which a computer uses to talk to itself. tshark, spelled t-shark, is Wireshark’s command-line tool. Dash capital D lists every interface it’s allowed to listen on. Let’s open the terminal and check.

Type tshark, space, dash capital D, and press Enter.

Each line is one interface Wireshark can capture from. We want the loopback one, l-o, because that’s where our practice website’s traffic flows on this machine.

Now let’s capture something for real, and apply our first filter.

Step 2 — capture on an interface

tshark -i lo -f "tcp port 8080" -w capture.pcapng -a duration:5
Part What it does
-i lo capture ON the loopback interface
-f "tcp port 8080" a CAPTURE filter — only keep traffic to/from port 8080
-w capture.pcapng write what we capture to a file, to look at afterward
-a duration:5 stop automatically after 5 seconds

Dash i chooses the interface, l-o. Dash f is a capture filter — a rule applied while we’re listening, so we don’t drown in unrelated traffic. tcp port 8080 means only keep packets going to or from door number 8080, which happens to be where our practice website lives. Dash w writes everything we catch into a file, so we can study it calmly afterward instead of watching it fly by. And dash a duration colon 5 just stops the capture automatically after five seconds. While that capture is running, in the background our practice website receives one login attempt — exactly the kind of ordinary moment a sniffer is built to catch.

Let’s run it and let it listen.

That’s it — five seconds of raw network traffic, saved to a file. Right now it’s just noise to us. We haven’t looked inside yet.

Time for our second kind of filter — a display filter, for reading what we already caught.

Step 3 — apply a display filter

tshark -r capture.pcapng -Y 'http.request.method=="POST"' -V
Part What it does
-r capture.pcapng READ from the file we just saved, instead of a live interface
-Y '...' a DISPLAY filter — only SHOW packets matching this rule
http.request.method=="POST" show only web requests that are SUBMITTING data, like a login form
-V show the full, readable detail of each matching packet

Dash r reads back the file we saved, instead of listening live. Dash capital Y is a display filter — different from the capture filter earlier. A capture filter decides what gets saved in the first place; a display filter just decides what we’re shown right now from what’s already saved, and you can change it as many times as you like without re-capturing anything. Our filter, http dot request dot method equals equals quote POST quote, means show me only the web requests that are submitting data, the kind a login form sends. And dash capital V asks for the full, human-readable detail of each one, instead of a single summary line. You’ll also see this pattern with ip.addr, which filters by a specific computer’s address — useful once a network has more than one device talking.

Let’s apply it.

And there they are again, in plain text: username equals admin, password equals password. This is the exact same moment from the start of the video, except now you know precisely how we got there — an interface, a capture filter, a file, and a display filter.

So why did that work at all? Why wasn’t this protected?

Why plaintext HTTP fails

Our practice website used plain HTTP, with no encryption at all. That means every single character you type into that login form travels across the network looking exactly like it did on your keyboard. Anyone in a position to sniff that traffic, on a shared Wi-Fi network, a compromised router, or an office network, reads it exactly the way we just did. There was no hacking involved, no password cracking, no guessing. We simply listened to a conversation that was never sealed.

That’s the whole reason encryption exists.

TLS, HTTPS, and SSH

HTTPS is just HTTP wrapped in an encryption layer called TLS, transport layer security. That’s the little padlock you see in your browser’s address bar. With TLS in place, a sniffer sitting in exactly the same spot still sees packets flying past, addresses, sizes, timing — but the actual payload, the words you typed, are scrambled into unreadable noise without the right key. SSH does the same job for logging into a remote computer’s terminal, which is exactly why it replaced an older, plaintext tool called telnet decades ago. Encryption doesn’t stop someone from sniffing. It makes sniffing useless.

One rule that never changes.

Before you go

Only ever capture traffic on a network you own, or have clear written permission to monitor. Sniffing someone else’s traffic without permission is illegal in most places, full stop. Everything you watched today happened entirely on our own machine, talking to our own practice website — nothing ever left this computer. Next time, we’ll open the full Wireshark graphical app and walk through that same capture file visually, packet by packet. Thanks for learning with The Exploit HQ, and I’ll see you there.