See It Yourself: Wireshark on Public WiFi

The point of this exercise

You read the article. You nodded. You maybe even thought “yeah that sounds bad.” But it’s abstract. It doesn’t feel real.

So let’s make it real. You’re going to use a free tool called Wireshark to look at the actual data traveling over a network. Your network. And you’re going to see, with your own eyes, how much of it is readable by anyone who cares to look.

This isn’t a hacking tutorial. Wireshark is a network analysis tool used by IT professionals, security researchers, and anyone who wants to understand what their devices are actually doing. It’s legal, it’s educational, and it’s the best way to stop pretending the threat isn’t real.

What you need

• A computer running Windows, macOS, or Linux
• Wireshark — free download from wireshark.org
• A wifi connection (your home network works fine for this demo)
• 10 minutes

Step 1: Install Wireshark

Download it from wireshark.org and install it. On Windows, it’ll ask if you want to install Npcap — say yes. That’s the driver that lets Wireshark capture network traffic.

On macOS, it’ll prompt you to install ChmodBPF. Follow the instructions. You may need to restart.

On Linux, it’s probably in your package manager. Ubuntu: sudo apt install wireshark. When it asks if non-superusers should be able to capture packets, say yes. Then add yourself to the wireshark group: sudo usermod -aG wireshark $USER. Log out and back in.

Step 2: Start capturing

1. Open Wireshark
2. You’ll see a list of network interfaces. Look for your active wifi adapter — it’ll show a little bouncing graph next to it indicating traffic.
3. Double-click that interface. Capture starts immediately.
4. You’ll see rows of packets scrolling by. A lot of them. This is normal. Your computer is constantly talking to the internet even when you’re not doing anything.

Step 3: Generate some traffic

Open your browser and do normal things:

• Visit a website (try one that still uses HTTP if you can find one — your router’s admin page is a good candidate)
• Check your email
• Open an app

Watch the packets scroll. Each row is one packet. The columns show:

• No. — packet number
• Time — when it was captured
• Source — who sent it
• Destination — who received it
• Protocol — what kind of traffic (TCP, UDP, TLS, DNS, HTTP)
• Length — how big
• Info — a summary of what’s in it

Step 4: The moment of truth

Here’s where it gets interesting.

Look at an HTTP request

In the filter bar at the top, type http and press Enter. Now you’re only seeing unencrypted HTTP traffic.

If you visited a site or router page over HTTP, you’ll see the requests. Click one. In the bottom pane, expand the “Hypertext Transfer Protocol” section. You can see the full request — the URL, the headers, and in some cases, form data.

That’s what an attacker on the same network sees. In plaintext. No effort required.

Now clear the filter and type tls instead. These are encrypted connections. You’ll see packets, but the info column just says “Application Data.” You can’t read the contents. Neither can an attacker. This is HTTPS doing its job.

Look at DNS queries

Type dns in the filter bar. Every entry is a domain your device looked up. You visited chase.com? There’s a DNS query for it. Checked email? There’s a query for your mail server.

An attacker on public wifi can see these too. They can’t see what you did on the site (if it’s HTTPS), but they know which sites you visited. This is called metadata, and it’s more revealing than you think.

Follow a TCP stream

Right-click any HTTP packet and select Follow → TCP Stream. A window pops up showing the entire conversation between your computer and the server, reconstructed into readable text.

If it was HTTP, you can read everything. Passwords submitted over HTTP. Session cookies. Search queries. All of it.

If it was HTTPS/TLS, you’ll see encrypted garbage. That’s the difference.

What you just learned

• HTTP traffic is fully readable by anyone on the same network. Wireshark just proved it.
• HTTPS traffic is encrypted. The network can see you connected to a server, but not what you sent.
• DNS queries are visible. The network knows which sites you’re visiting even when the content is encrypted.
• The difference between safe and unsafe is literally visible in the protocol column. TLS = encrypted. HTTP = not.

The bigger picture

What you did here — passively observing traffic on a network you’re connected to — is the same thing an attacker does on public wifi. The only difference is they’re doing it to your traffic instead of their own.

On your home network, you’re probably fine. Your router encrypts wifi traffic between your device and the router (WPA2/WPA3), so someone outside your house can’t see it. But on public wifi, there’s no such encryption between you and the router. Everyone on the network is in the same room, metaphorically speaking.

That’s why a VPN matters. With a VPN, everything between your device and the VPN server is encrypted. Wireshark on the local network would show TLS traffic to your VPN server and nothing else. No DNS queries, no HTTP leaks, no metadata. Just encrypted noise.

Try this

If you want to really see the difference:

1. Capture traffic without a VPN. Note the DNS queries, the HTTP requests, the readable data.
2. Turn on a VPN.
3. Capture again. Filter for dns — nothing. Filter for http — nothing. It’s all TLS to one server.

That’s the entire argument for VPNs on public wifi, demonstrated in about two minutes.

The bottom line

Wireshark isn’t a hacking tool. It’s a mirror. It shows you what’s already visible to anyone who looks. The question isn’t whether someone is watching — it’s whether you’ve made sure there’s nothing worth seeing.

Use HTTPS. Use a VPN on public wifi. And now you know why, because you saw it yourself.