Wireshark — traffic analysis

In a nutshell Wireshark captures the actual packets flowing over a network and shows them to you, decoded layer by layer. Where Nmap asks "what's there?", Wireshark answers "what exactly is being said?" — letting you see a login sent in the clear, a protocol misbehaving, or malware phoning home.

What it does — the layers peeled open

Wireshark records every frame the card sees and decodes each through the layers (see OSI & TCP/IP models):

Every packet is a nested set of headers — Wireshark peels them to the real payload.

You get the raw truth of what crossed the wire: MAC (L2), IPs (L3), ports & TCP (L4), and the actual content (L7).

Analogy — a transcript of every conversation in a room. Nmap tells you which phones are on. Wireshark hands you the word-for-word transcript of every call — who spoke to whom, and exactly what they said.

Staying afloat — filters

A busy capture is thousands of packets a second. Display filters narrow the flood:

ip.addr == 10.10.10.5           only traffic to/from this host
tcp.port == 80                  only web traffic
http                            only HTTP
dns                             only DNS queries/answers
http.request.method == "POST"   only form submissions

Then right-click a packet → Follow TCP Stream to reassemble a whole conversation into one readable block.

What you actually hunt for

Clear-text credentials — plain HTTP, FTP, Telnet send usernames and passwords unencrypted; they sit right there in the bytes. The visceral lesson in why HTTPS matters.
What a host talks to — filter by a suspicious machine; is it beaconing to an unknown server at regular intervals (malware)?
Protocol behaviour — the TCP handshake, retransmissions, a stalling TLS handshake, DNS failing — gold for attacking and fixing alike.

The limit that proves the point Wireshark shows what's there. If the traffic is HTTPS, the L7 content is encrypted — you see the connection, its size and timing, but not the messages. That's exactly the protection HTTPS gives; Wireshark makes the HTTP-vs-HTTPS difference tangible. (Capturing traffic you're not authorized to see is still a legal boundary.)