Wireshark
Wireshark is a free, open-source network protocol analyzer that captures and inspects network traffic in detail, allowing security professionals and network engineers to troubleshoot issues and analyze packets down to the byte level.
Definition
Wireshark is a free, open-source network protocol analyzer that captures and inspects network traffic in detail, allowing security professionals and network engineers to troubleshoot issues and analyze packets down to the byte level.
Overview
Wireshark captures live network traffic or reads previously saved capture files and decodes hundreds of protocols, presenting each packet's headers and payload in a human-readable format. Its deep protocol dissection and powerful display-filter syntax make it possible to isolate a single conversation out of millions of packets, inspect TCP handshakes, or examine the contents of unencrypted application-layer traffic. In security work, Wireshark is commonly used during Penetration Testing and incident response to analyze suspicious network activity, verify whether data was exfiltrated, or confirm how malware communicates with command-and-control infrastructure. Network engineers also rely on it for everyday troubleshooting — diagnosing latency, misconfigured routing, or failed connections. Built on the libpcap/WinPcap packet-capture libraries, Wireshark runs on Windows, macOS, and Linux, and its command-line counterpart, tshark, allows the same capture and filtering capabilities to be scripted or automated. Because it exposes raw traffic including unencrypted credentials on insecure protocols, it is also a valuable teaching tool for demonstrating why encryption protocols like TLS matter. It is often mentioned alongside Nmap in this space.
Key Features
- Deep packet inspection across hundreds of supported protocols
- Powerful filter syntax for isolating specific traffic or conversations
- Live capture and offline analysis of saved packet capture files
- Cross-platform support for Windows, macOS, and Linux
- Command-line variant (tshark) for scripting and automation
- Visualization tools including flow graphs and I/O statistics
- Free and open-source with an active contributor community