Wireshark collects network traffic from the wire through the computer's network interface, running in promiscuous mode (if needed), to inspect and display information related to protocols, IP addresses, ports, headers, and packet length. The following diagram is an illustration of how all the elements work together to display packet-level information to the user (source: https://www.wireshark.org):
Wireshark comes with the Winpcap/libcap driver, which enables NIC to the run in promiscuous mode; the only time you don't have to sniff in promiscuous mode is when the packets are directly, intentionally destined/generated to ...
