That are color-coded black are those that have an error. You can change the options for how the color-coding works in the View > Coloring Rules menu in the top menu bar. Once you have a list of packets at your disposal, Wireshark color-codes them so you can browse If you want to stop capturing live traffic, press the red button on the toolbar. The checkbox can be found in the Capture > Options menu on the top bar. Make sure you have checked Promiscuous mode on. If you want to see all the packets on the network rather than just those addressed to you, Wireshark will provide you with all the interfaces detected when you start it up but make sure you choose the correct one. To start capturing, you need to select the correct interface to start capturing from. Wireshark can capture live information from your current network.

Finally, the status bar on the bottom gives you general information on the program’s current status and captured data.

The packet bytes pane will list data on a byte-by-byte basis, highlighting the packet you selected for further observation.

The packet details pane will provide more information on the selected packet.

Selecting an item from this list will change what you can see in the following sections. It contains a list of all packets going through your network.

The packet list pane is the primary data source.

Filters will make it easier to find the correct packets to trace.

The filter toolbar allows you to display filters to choose from.It contains frequently used actions so you have easy access to them without having to navigate multiple menus to find them.

The menu is used to start all actions on Wireshark.

How to use wireshark for dummies