Small Town Sysadmin
Free CJIS checklist

Useful tools

Wireshark for small-shop troubleshooting: what it's for and how to use it safely

When a problem only makes sense at the packet level, Wireshark shows you exactly what's happening, including captures taken on your firewall. Here's how to use it safely.

Some problems don’t make sense until you see the actual traffic. Phones that won’t register, a device that never gets an address, a vendor insisting the problem is on your side. Wireshark lets you see exactly what devices are saying to each other, so you can stop guessing.

Tool What it’s for Business use Official download
Wireshark Capturing and reading network traffic Free and open source wireshark.org/download

What it does

Wireshark captures network traffic and decodes it protocol by protocol, from low-level Ethernet frames up through DNS, DHCP, SIP, HTTP, and hundreds more. You can filter a capture down to one device or one conversation, follow a stream from start to finish, and save captures to share with a vendor or review later.

When to reach for it

  • VoIP phones that won’t register or calls with one-way audio
  • A device that can’t get a DHCP lease
  • DNS answers that don’t match what you expect
  • Proving to an ISP or vendor exactly where a problem is
  • Reading a capture your firewall took, to see whether traffic is leaving the building

Reading captures from your firewall

You don’t always have to capture from a laptop. Most business firewalls can run a packet capture on their own interfaces and save it as a standard pcap file that Wireshark opens directly. That’s often the best place to capture, because the firewall sees traffic on both sides: what arrives from the LAN, and what actually leaves (or doesn’t leave) on the internet side.

Where to find it on a few firewalls common in small shops:

  • FortiGate: in FortiOS 7.2 and later, go to Network > Diagnostics and use the Packet Capture tab. Filter by host, port, or protocol, run the capture, then click Save as pcap.
  • pfSense: go to Diagnostics > Packet Capture, run the capture on the interface you care about, then click Download. It’s a front end to tcpdump, so the file is standard pcap.
  • SonicWall: go to Investigate > Packet Monitor, run the capture, then use Export As and choose Libpcap. SonicWall also recommends exporting the HTML version, which includes firewall-specific details, like drop codes and interfaces, that the pcap doesn’t.

Other vendors have similar tools under names like “packet capture,” “sniffer,” or “packet monitor.” If yours saves pcap or pcapng, Wireshark reads it. Beyond those two native formats, Wireshark can also open capture files from a long list of other capture tools.

A useful trick: capture on both the LAN and WAN interfaces while you reproduce the problem (at the same time, if your firewall allows more than one capture). If traffic shows up on the LAN side but never on the WAN side, the firewall (a rule, NAT, or routing) is your culprit. If it leaves the WAN but nothing comes back, the problem is upstream.

Firewall captures can grab traffic from the whole office, not just the device you’re troubleshooting. Always filter the capture to the host or port you need, and handle the file carefully (see below).

Installing it on Windows

The official Windows installer includes Npcap, the driver Wireshark needs for live capture. Without Npcap, you can still open saved capture files, but you can’t capture new traffic.

Silent-install gotcha: if you deploy Wireshark with the installer’s /S silent switch, it does not install Npcap. Live capture won’t work on that machine until you install Npcap separately.

Official packages are signed by the Wireshark Foundation, so only download from wireshark.org.

Licensing fine print

Wireshark itself is free and open source. Npcap is a separate product from the Nmap Project with its own license terms, which the Wireshark Foundation has permission to bundle. If you plan to deploy Npcap widely, read its license first.

Handle captures carefully

A capture can contain anything that crossed the wire, including passwords sent in clear text and sensitive records.

  • Capture only what you need. Use a capture filter to limit it to the device or traffic you’re troubleshooting.
  • On CJIS or banking networks, treat capture files like the data inside them. Store them securely, don’t email them around, and delete them when you’re done.
  • Get permission first. Capturing traffic on a network you don’t manage, or without the owner’s okay, can create real legal and policy problems.

Official download: Wireshark download page

Sources

All articles