Capturing Your First Web Request with Wireshark on Windows

A live packet capture in Wireshark, filtered down to a single request and response, so you can see exactly what your browser sends and receives at the network level.

Prerequisites

Windows 11 Pro (64-bit), Wireshark installed, connected to Wi-Fi. No prior networking experience required.

Steps

1. Open Wireshark. You will see a list of interfaces (Wi-Fi, Ethernet, Loopback) with live traffic graphs.
2. Double-click your Wi-Fi interface to start capturing.
3. Open your browser and visit http://example.com.
4. Return to Wireshark and click the red square to stop the capture.
5. In the display filter bar, type http and press Enter to narrow the list to HTTP traffic.
6. Find your GET request to example.com in the list, right-click it, and choose Conversation Filter → TCP to isolate just that exchange.
7. Click on the GET request packet, then expand Hypertext Transfer Protocol in the details pane to see the request.
8. Click on the matching 200 OK response packet to see the reply.

Verification

The filtered list shows a short, self-contained exchange: a few TCP setup packets, one GET request, and one 200 OK response, instead of the full, unfiltered flood of background traffic.

Troubleshooting

1. The unfiltered capture shows an overwhelming number of unrelated IP addresses moving constantly. This is normal background traffic (Windows Update, background apps), not something you did wrong. Filtering with http and Conversation Filter narrows it to what matters.
2. The first HTTP packet you click on may not be your own browser traffic at all. Windows generates its own background HTTP traffic, such as update checks. Generate your own traffic deliberately by visiting a known site, rather than clicking the first packet you see.