Wireshark

What it is

Wireshark is a free network protocol analyser, maintained by the Wireshark Foundation and contributors (project lineage dating to 1998), that captures packets from a network interface or opens saved capture files and presents dissected protocol fields in an interactive three-pane browser. TShark provides the same engine in a terminal-oriented form.

What it helps with

- Capture live traffic or open pcap, pcapng and many vendor capture formats.
- Inspect hundreds of protocols down to individual fields.
- Filter packets with a rich display-filter language during analysis.
- Analyse VoIP and other multimedia streams where dissectors support it.
- Decrypt selected protocols (for example TLS) when session keys or secrets are available.
- Troubleshoot connectivity, investigate incidents and teach how protocols behave on the wire.

Who it's for

Network engineers, SOC and IR analysts, forensic practitioners, security researchers, and students learning protocol behaviour.

Worth knowing

Capturing packets often needs elevated privileges and a capture driver such as Npcap on Windows. Capture and inspect only traffic you are authorised to monitor. Wireshark is distributed under GPL-2.0 with no licence fee for the full application. Platforms stated by the project include Windows, macOS, Linux and other Unix-like systems. Attribution: licence and platform FAQ on wireshark.org; about page for project stewardship.