See What Your PC Is Doing Online - Wireshark Beginner Guide

Your PC chats with the internet constantly. Updates, background apps, browser tabs, that one program you installed last year - they all send and receive little packets of data without telling you. Usually it is harmless. Sometimes it is not.

The good news: a free tool called Wireshark lets you see every one of those conversations in plain view. This guide gets you from "I have no idea" to "oh, so that is what was happening" in a few minutes.

Step 1: Install Wireshark

Download Wireshark and run the installer. When it offers to install something called "Npcap", say yes - that is the small helper that actually lets Wireshark see your network traffic. Click through the rest with the default options.

Reboot if it asks. Done.

Step 2: Pick your connection and start listening

Open Wireshark. You will see a list of network connections, each with a little wiggly line next to it. The one with the most movement is almost always your active internet connection - usually named "Wi-Fi" or "Ethernet."

Double-click it. Lines start scrolling immediately. Congratulations, you are now watching your PC's live internet traffic.

Step 3: Make sense of the scroll

It looks chaotic, but you only need three columns to start:

• Source and Destination - who is talking to whom. Your PC's address is one side; the other side is wherever it is connecting to.
• Protocol - the "language" being used, like TLS (secure web traffic), DNS (looking up website names), or QUIC (used by Chrome and YouTube).
• Info - a short plain-text summary of what that packet is doing.

Let it run for thirty seconds, then stop the capture with the red square button so the screen stops moving.

Step 4: Find out who your PC is talking to

Here is the genuinely useful trick. In Wireshark, click Statistics at the top, then Conversations, then the TCP or IPv4 tab.

This gives you a clean list of every destination your PC contacted, sorted by how much data went back and forth. No scrolling required. If one mystery address is sending or receiving a lot, that is your cue to investigate.

Step 5: Filter out the noise (optional but lovely)

The bar near the top is a filter box. Type a word, press Enter, and Wireshark hides everything else. A few beginner-friendly ones to try:

• dns - shows only the website-name lookups, a quick way to see which sites your PC is reaching for.
• http - shows unencrypted web requests, which are increasingly rare and worth a curious look.
• tls - shows secure connections, which is most normal browsing.

When should you actually worry?

Most traffic is boring and legitimate. Be a little curious if you see steady traffic to an unfamiliar destination while you are not actively doing anything, or a program you do not recognize generating constant chatter.

Wireshark will not remove anything for you - it is a window, not a guard. But knowing what is there is the first step. From there, a good cleanup tool or a careful look at your installed programs usually sorts it out.

Ready to take a look for yourself? Grab Wireshark free here and run your first capture today.