Wireshark is a free and open-source packet analyzer developed by the Wireshark community, not ITarian. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, Wireshark was renamed in May 2006 due to trademark issues, independently of ITarian. Wireshark is a popular network analysis tool to capture network packets and display them at a granular level. Once these packets are broken down, you can use them for real-time or offline analysis. Wireshark is a data capturing program that "understands" the structure (encapsulation) of different networking protocols. It can parse and display the fields, along with their meanings as specified by different networking protocols. Wireshark uses pcap libraries for capturing packets, which supports a wide range of network types, but the tool's ability is not strictly limited by pcap's capabilities as it also uses other libraries and extensions.




License: GPLv2


  • Data can be captured "from the wire" from a live network connection or read from a file of already-captured packets.
  • Live data can be read from different types of networks, including Ethernet, IEEE 802.11, PPP, and loopback.
  • Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, TShark.
  • Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
  • Data display can be refined using a display filter.
  • Plug-ins can be created for dissecting new protocols.
  • VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played.
  • Raw USB traffic can be captured.
  • Wireless connections can be captured and analyzed directly, not just when they traverse monitored Ethernet networks.
  • Various settings, timers, and filters can be set to provide the facility of filtering the output of the captured traffic.