# Wireshark Essentials

> Capture wireless traffic locally and remotely, filter 802.11 frames, and decrypt WPA traffic to extract credentials with Wireshark and tshark.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/wireshark-essentials
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

Wireshark and its command-line companion tshark are how you read what is happening in the air. PEN-210 uses them to capture 802.11 traffic, isolate frames of interest with display filters, confirm a captured handshake, and, once you hold the key, decrypt and inspect the protected traffic. Fluency with capture and filtering underpins every attack: you cannot exploit what you cannot see.

## Capturing Wireless Traffic

Beyond a local monitor-mode capture, you can pull frames from a remote sensor over SSH straight into a local Wireshark, useful when the target is out of range of your workstation. On open networks, capturing on the target channel exposes plaintext application traffic, and tshark extracts credentials, cookies, and HTTP content directly from the command line for fast triage.

## Decrypting and Analyzing

A WPA/WPA2 capture is encrypted until you supply the key. With the PSK (and a captured four-way handshake) airdecap-ng decrypts the capture offline, or Wireshark decrypts inline once the key is configured. From the decrypted stream you extract credentials and session data, and combining multiple capture files gives a complete picture of the client's activity on the network.

## Study material

- [Remote Wireless Packet Capture over SSH](https://hackindex.io/platforms/wireless/enumeration/remote-packet-capture-over-ssh.md) (read, core)
- [Capturing Plaintext Traffic on Open Networks](https://hackindex.io/platforms/wireless/exploitation/capturing-plaintext-traffic-open-networks.md) (read, core)
- [Decrypting WPA Traffic with Airdecap-ng and Wireshark](https://hackindex.io/platforms/wireless/post-exploitation/decrypting-wpa-traffic-airdecap-wireshark.md) (read, core)