How to Monitor Visited Websites Using Wireshark

By Chris Hoffman

Wireshark can monitor all network traffic to and from your computer, and can also monitor network traffic from other computers on your network using "promiscuous" mode. Depending on your network setup, Wireshark may or may not receive and monitor network traffic from other computers on your network. You can filter the network traffic by the ports and protocols Web browsers use to see the IP addresses of the websites people are visiting on your computer or network.

Step 1

Launch Wireshark. Click the name of a network interface under Interface List in the Wireshark window that appears. For example, click the name of your wireless network card to monitor a wireless network or the name of your wired network adapter to monitor a wired network. Wireshark automatically starts capturing packets, displaying them as they arrive.

Step 2

Type “tcp.port == 80” into the filter box at the top of of the Wireshark window and press “Enter” to filter the packets by Web browsing traffic.

Step 3

Identify a website someone on your network or computer is visiting by typing the IP number from the Destination column in the Wireshark window into your Web browser’s address bar and pressing “Enter.” The visited website loads in your Web browser.

Tips & Warnings

  • Wireshark can only monitor visited websites on your network if it’s receiving network traffic. Even when using "promiscuous" mode, Wireshark may not receive enough packets to monitor visited websites from other computers on your network. You can receive every packet meant for other computers on the network by using the Windows Internet Connection Sharing feature, which routes all network traffic through a single computer.