Searches for packets based on multiple criteriaĬolorizes packets according to display filters Imports/exports packets into a number of file formats, supported by other capture programs The main features of Wireshark are as follows:Ĭaptures live packet data from a network interfaceĭisplays packets along with detailed protocol information

People use it to learn more about network protocol internals.īeside these examples, Wireshark can be used for many other purposes. Network security engineers use it to examine security problems.ĭevelopers use it to debug protocol implementations. Network administrators use it to troubleshoot network problems. Here are some examples of how Wireshark is typically used: Wireshark is, perhaps, one of the best open source packet analyzers available today. It also allows you to modify and customize the source code. Wireshark is released under the terms of the GNU General Public License, which means you can use the software and the source code free of charge. However, with the advent of Wireshark, all that has changed. In the past, such tools were either very expensive, proprietary, or both.

You could think of a network packet analyzer as a measuring device used to examine what is going on inside a network cable, just like a voltmeter is used by an electrician to examine what is going on inside an electric cable. It uses WinPcap as its interface to directly capture network traffic going through a network interface controller (NIC).

Wireshark (originally named “Ethereal”) is a network packet analyzer that captures network packets and displays the packet data as detailed as possible.