Download June 2015

Once you've collected a bit of data, scroll back to the top and see whether there are any interesting captures.
(Note: With Win8, the Packet List view might be too small and not resizable. Click View in the Wireshark
toolbar and uncheck Packet Details and Packet Bytes.) I have a home-based peer-to-peer network, so
Wireshark shows packets from a server that's poking around the net, requesting information.
To sort through some of the collected packet data, it helps to know the IP addresses for the key systems on
your network. (Keep in mind that this use of Wireshark is collecting information on packets traveling across
the local network connection — those sent and received by the PC running Wireshark.)
For the IP address of the system you're examining, open a command window and type ipconfig /all at the
prompt. Hit Enter. In the resulting list, look for IPv4 Address in the Ethernet adapter section. In my case it's
192.168.1.27 (see Figure 3), but it could also be something such as 10.0.0.19. Scroll down a little farther and
look for Default Gateway and DHCP server, the addresses for your local router. In my case, they're
192.168.1.1.
(Note: Your router's management menus can also provide IP-address information on devices on the local net. It
might be under a heading similar to "Connected devices.")
Figure 3. Windows' IPConfig will display the IP address for both the PC and the connected router.
Back in Wireshark, the Packet List has IP source and destination columns. When your PC connects to a site on
the Web, the packets sent are listed in the Source column. The Destination column tells you where the packets
are going. If the destination IP address isn't a local device, you find out who owns it by Googling "whois"
followed by the IP address — or use your favorite whois tool.
For example, a sample capture (Figure 4) shows that I'm sending to and receiving from IP address
216.52.233.173, which I suspect is my LogMeIn connection. Looking that address up in ipdb.at confirms that
216.52.233.173 is indeed LogMeIn (Figure 5).