Troubleshooting Slow Internet with Wireshark: A Step-by-Step Guide

Whether you’re working from home, managing a corporate LAN, or simply gaming online, nothing is more frustrating than sluggish network performance. Wireshark lets you peer under the hood of your traffic and pinpoint exactly where the bottleneck lies. In this guide, we’ll walk you through capturing, filtering, and interpreting packet data to diagnose—and ultimately fix—slow Internet issues.

Step 1: Set Up Your Capture
  • Choose the right interface
    • For wired connections, pick the Ethernet NIC.
    • For Wi‑Fi, select the wireless adapter (ensure in “monitor” or “promiscuous” mode if needed).
  • Apply a simple capture filter (to reduce noise)
    • host 8.8.8.8 or port 80 or port 443

    This captures traffic to Google DNS and HTTP/HTTPS.

  • Start capturing, then reproduce the slowdown (e.g., load a video).
  • Stop capture once you’ve seen sluggish behavior for several seconds.

    • Tip: Save your capture as .pcapng for later comparison.

Step 2: Get a Bird’s‑Eye View with IO Graphs

Go to Statistics → I/O Graphs.

Plot bytes per tick over time on your main interface.

Look for dips or flat lines where throughput collapses.

If you see repeated troughs, note their timestamps for deeper analysis.

Step 3: Identify Packet Loss & Retransmissions

Excessive retransmissions often signal packet loss:

  • Display filter:
    • tcp.analysis.retransmission
  • Count events: Statistics → Conversations → TCP, then check the Retransmissions column.

High retransmission rates usually point to:

  • Bad cabling or Wi‑Fi signal issues
  • NIC driver bugs
  • ISP line problems
Step 4: Measure Latency (Round‑Trip Time)

Enable the Round‑Trip Time (RTT) column:

  • Right‑click on any column header → Column Preferences.
  • Add a new column: Field name = tcp.analysis.ack_rtt, Title = “RTT”.

Sort by “RTT” and inspect the highest values.

Note which flows (IP pairs, ports) have elevated RTTs—these are your latency offenders.

Step 5: Check DNS Resolution Delays

Slow name lookups can stall web pages:

  • Display filter:
    • dns && dns.response_in > 0
  • Add column for dns.time: Field name = dns.time, Title = “DNS Latency”.

Sort by DNS Latency; anything above ~200 ms is suspect. If your local resolver is slow, try switching to a public DNS (e.g., 1.1.1.1, 8.8.8.8) and re‑test.

Step 6: Pinpoint Application‑Level Delays

For HTTP(S) or other application protocols:

  • HTTP timing:
    • Filter:
      • http && tcp.port == 80
    • Use Follow → HTTP Stream to see request/response gaps.
  • TLS handshake delays:
    • Filter:
      • tls.handshake.type == 1
    • Check time between ClientHello and ServerHello.

Long gaps here can indicate server slowness or network congestion.

Step 7: Diagnose Local Network Issues (ARP, DHCP)

Local‑layer problems can masquerade as Internet slowness:

  • ARP storms:
    • arp

    Look for excessive ARP requests without replies.

  • DHCP delays (if you’re on dynamic addressing):
    • bootp

    A slow DHCP lease renewal can disrupt connectivity.

Step 8: Compare Against a “Good” Trace

Always benchmark against a capture taken when speeds are normal:

  • Capture a session while Internet is fast.
  • Compare key metrics: throughput, retransmission %, RTT, DNS times.

Use Statistics → Compare (Wireshark’s “diff” engine) or simply eyeball the I/O Graphs side by side.

Step 9: Leverage Expert Information

Wireshark’s built‑in Expert Info flags anomalies:

  • Go to Analyze → Expert Information.
  • Look for Warnings and Errors like “Out‑of‑order packets,” “Zero window,” or “Duplicate ACKs.”

These give you a prioritized list of issues to tackle first.

Step 10: Take Action & Validate

Replace faulty cables or move closer to Wi‑Fi AP.

Update NIC drivers and firmware.

Switch DNS servers if lookups are slow.

Contact ISP with your .pcapng evidence if external line issues persist.

After making changes, re‑capture and compare to ensure your fixes actually improved performance.

Conclusion

Slow Internet can stem from physical‑layer hiccups, DNS snafus, or application‑level bottlenecks. Wireshark arms you with the data to cut through guesswork:

  • Capture smartly (use filters).
  • Visualize trends (I/O graphs).
  • Quantify anomalies (retransmissions, RTT, DNS latency).
  • Compare & validate against a known‑good state.

Armed with these steps, you’ll go from “Why is it so slow?” to “Here’s exactly what’s wrong—and how to fix it.” Happy troubleshooting!