Logo
A Beginner's Guide to OSINT: Uncovering Digital Footprints Ethically
Threat Intelligence

A Beginner's Guide to OSINT: Uncovering Digital Footprints Ethically

Redefen Cybersecurity Team May 26, 2025
❝ Welcome to the exciting world of ethical hacking! If you’re new to cybersecurity, you've likely heard of Nmap... ❞

Ready to peek inside the world of cybersecurity? If you’re new to ethical hacking or network defense, Wireshark is your ticket to understanding how data flows across networks. This free, open-source tool lets you capture and analyze network traffic, revealing what devices are saying to each other.

In this beginner’s guide, we’ll explain what Wireshark is, how to use it safely, and why it’s a must-have skill for aspiring cybersecurity pros. Plus, we’ll connect it to our free 3-week ethical hacking course to kickstart your journey. Let’s start sniffing packets!

What is Wireshark, and Why Should You Learn It?

Wireshark is like a stethoscope for networks, letting you “listen” to data packets as they travel between devices. Each packet contains information—like website requests, emails, or even login credentials—making Wireshark a powerful tool for both ethical hackers (Red Team) and defenders (Blue Team).

  • Capture live network traffic: e.g., HTTP, DNS, TCP.
  • Analyze packets: Identify services, protocols, or suspicious activity.
  • Troubleshoot network issues: Spot problems or security threats.
  • Hands-on learning: Understand how networks function in real time.

Why Learn Wireshark in 2025?

  • Free & Accessible: Available for Windows, macOS, Linux, and pre-installed in Kali Linux.
  • Industry Staple: Trusted by cybersecurity pros and network engineers.
  • Beginner-Friendly: Visual interface makes analysis easy.
  • Future-Ready: Useful for cloud security and AI-related threats.
  • Career Edge: Vital for certifications like CompTIA Security+, CEH, and CyberSec First Responder.

Wireshark’s Role in Cybersecurity

Wireshark plays a major role in both offensive and defensive security:

  • Red Team (Ethical Hacking): Capture unencrypted credentials or attack patterns.
  • Blue Team (Defense): Detect malware, suspicious traffic, or unauthorized scans.

For example, a hacker might use Wireshark to sniff unsecured Wi-Fi, while a defender might use it to catch a data breach. Learning Wireshark opens doors to roles like Junior SOC Analyst or Network Security Specialist.

Getting Started with Wireshark: Step-by-Step Tutorial

Let’s set up Wireshark and capture your first packets in a safe, legal environment.

Step 1: Set Up Your Free Environment

  1. Install Kali Linux: Download the free Kali ISO and run it in VirtualBox. Wireshark comes pre-installed.
  2. Alternative Install:
    • Windows/macOS/Linux: Download from wireshark.org
    • Linux: Run sudo apt-get install wireshark and configure permissions.
  3. Safe Practice: Use TryHackMe labs or your own network (with permission). Never sniff unauthorized networks.

Step 2: Capture Your First Packets

  1. Open Wireshark in Kali Linux (or your OS).
  2. Select a network interface (e.g., eth0 for Ethernet, wlan0 for Wi-Fi).
Pro Tip: Always filter your packets (e.g., http, dns) to focus on what matters most.

Step 2 Continued: Capturing Traffic

  1. Tip: Use ifconfig (Linux) or ipconfig (Windows) to identify interfaces.
  2. Click “Start” to capture live traffic.
  3. Generate traffic: Visit a safe website like example.com.
  4. Stop the capture using the red square button after 10–20 seconds.

What’s Happening?

Wireshark grabs packets showing metadata like source/destination IPs, protocols (e.g., HTTP), and payload data. You’ll see a colorful stream of packets appear in the main window.

Step 3: Analyze HTTP Traffic

  1. In the filter bar, type http and press Enter.
  2. Look for packets with GET or POST requests (e.g., browsing example.com).
  3. Right-click a packet → Follow > HTTP Stream to view the full web exchange.
GET / HTTP/1.1
Host: example.com
...
HTTP/1.1 200 OK
Content-Type: text/html

This output shows a browser requesting a webpage and the server's response. Great for seeing traffic flow end-to-end.

Step 4: Explore Key Features for Beginners

  • Filter by IP: ip.addr == 192.168.1.100 (replace with your target IP).
  • DNS Analysis: Use dns to find domain queries.
  • Export Data: Save captured objects: File > Export Objects > HTTP.
  • Cloud Traffic (2025 Trend): In TryHackMe labs, analyze AWS or Azure traffic.

Wireshark in Action: Real-World Scenarios

Red Team Scenario:

  1. Capture traffic on a Wi-Fi interface.
  2. Spot unencrypted HTTP logins.
  3. Report insecure configurations (recommend HTTPS).

Blue Team Scenario:

  1. Monitor for unusual DNS queries using Wireshark.
  2. Detect malware "phoning home" to known IPs.
  3. Block suspicious IPs using firewalls (e.g., ufw), alert the team.

Both roles are covered in our free course — blending attack and defense!

Defending Against Packet Sniffing (Blue Team Tips)

  • Use HTTPS: Always ensure sites use TLS (look for the padlock icon).
  • Enable VPNs: Encrypt all traffic using a VPN like ProtonVPN (free tier available).
  • Monitor Traffic: Use IDS tools like Snort to detect packet sniffing.
  • Secure Wi-Fi: Use WPA3 or strong WPA2 passwords to prevent interception.

Wireshark and Your Cybersecurity Career

Mastering Wireshark can launch your path into cybersecurity roles like:

  • Junior SOC Analyst: Analyze network threats in real time.
  • Network Security Specialist: Secure and troubleshoot complex networks.
  • Ethical Hacker: Capture packets to uncover vulnerabilities.
  • Cybersecurity Intern: Start with traffic analysis and grow from there.

It’s also a core skill for certifications like CompTIA Security+, CEH, or Network+.

Common Wireshark Pitfalls for Beginners

  • Unauthorized Sniffing: Only analyze traffic on networks you own or have permission for.
  • Overwhelming Data: Use filters like http or dns to simplify views.
  • Missing Encryption: Don’t assume safety — inspect if traffic is HTTPS.
Pro Tip: Try TryHackMe’s free “Wireshark” room for step-by-step practice.

Bonus: Wireshark in 2025 – Cloud and AI Insights

  • Cloud Security: Analyze AWS or Azure traffic for misconfigurations or leaks.
  • AI-Driven Attacks: Spot patterns from AI-powered threats.
  • IoT Networks: Monitor smart devices for unsecured protocols and unusual behavior.

TryHackMe’s free cloud labs let you practice detecting modern threats in realistic scenarios.

Join Redefen’s Free Cybersecurity Course

Wireshark is just the beginning. Our Introduction to Ethical Hacking & Cybersecurity Defense Course also covers:

  • Advanced Wireshark filters, plus tools like Nmap and Metasploit.
  • Networking fundamentals and operating system basics.
  • Blue Team strategies: IDS, firewalls, threat detection.
  • Career preparation: CV templates, LinkedIn help, and beginner CTFs.