How to Port Forward Wireshark

Port forwarding helps you access the client’s server behind the router or firewalls, NAT or CGNAT. You can open ports and control devices behind any router. This guide explains how to port forward Wireshark.

What is Wireshark?

Wireshark is an open-source packet analyzer that captures and inspects network traffic in real-time. It’s widely used for:

• Network troubleshooting (e.g., latency, packet loss)
• Security analysis (detecting malicious traffic)
• Protocol debugging (HTTP, DNS, TCP/IP)
• Performance monitoring (bandwidth usage, bottlenecks)

Wireshark captures traffic at the packet level, allowing deep inspection of headers, payloads, and protocols.

Why Port Forward for Wireshark?

At first glance, Wireshark doesn’t require port forwarding—it captures traffic locally. However, there are scenarios where port forwarding enhances Wireshark’s capabilities:

1. Remote Packet Capture

If you need to analyze traffic from a remote device (e.g., a server, IoT device, or another computer), port forwarding allows Wireshark to receive mirrored traffic from that device.

2. Traffic Mirroring (Port Mirroring/SPAN)

Some routers support traffic mirroring, where all traffic from a specific device is duplicated and sent to another port. By forwarding this mirrored traffic to a machine running Wireshark, you can monitor network activity without interrupting normal operations.

3. Analyzing External Attacks

Security researchers use port forwarding to simulate and inspect inbound attacks (e.g., DDoS, port scanning) in a controlled environment.

4. Debugging Port-Specific Issues

If an application isn’t working on a forwarded port (e.g., a game server or web app), Wireshark can help diagnose whether the traffic is reaching the destination correctly.

Requirements to Port Forward Wireshark

Just before you begin with the process of port forwarding, make sure you have the following things:

• Downloaded and installed the Wireshark server.
• The IP address of your router.
• IP address of your device.

TCP and UDP ports of Wireshark for your device as mentioned in the section below.

Step-by-step guide on how to port forward Wireshark

Now that you have the above details noted down, you can move to the next stage of Wireshark port forwarding:

1. On your web browser address bar, type your router’s IP Address/Default Gateway.
2. Log in with your router’s credentials (username and password) to view your router’s firmware settings.
3. Navigate to the port forwarding section of your router.
4. Click on Port Forwarding.
5. Enter the IP address of your device in your router in the correct box.
6. Put the TCP and UDP ports of the Wireshark server in the boxes in your router. The default Wireshark port number is 9876. And then click the apply button.
7. And you’re done. Restart your router to let the changes take effect.
8. Once your changes take effect, now you can host a Wireshark server and let your friends connect to it as well. To let them connect to it, you need to provide them the hostname you are using, along with the port number. For example, ‘hostname.domain.com:25565’.

Wireshark ports needed to run

To use Wireshark online and create a server without any interruptions, you’ll have to allow access to certain ports on your firewall. The default Wireshark ports are:

TCP Port: 9876

Ports to forward on devices

Ports to run on PC:

TCP Port: 9876

How to open ports behind CGNAT

What if your ISP performs CGNAT? Most ISPs perform CGNAT (Carrier-grade Network Address Translation) to conserve bandwidth and assign a single IP address to multiple users connected to the same internet network. However, CGNAT makes it difficult for you to open ports on the router. 

To get around the CGNAT issue, you can use the Port Forwarding add-on to bypass this problem and port forward routers without hassle. 
Here’s more information on how to use PureVPN’s Port Forwarding add-on and bypass CGNAT in a few clicks.

PureVPN’s Port Forwarding Add-on

To most people, port forwarding is quite a demanding task. For starters, every router has a different console, which often makes it difficult to navigate to specific settings.

Secondly, you won’t always be able to open Wireshark ports on your router if your ISP restricts the ports. Yes, you heard that right! ISPs are notorious for blocking ports due to security reasons. If ISP isn’t the reason behind a blocked port, then perhaps it could be your operating system’s firewall.

Frequently Asked Questions