Wireshark

Wireshark is a graphical network protocol analyzer for capturing and examining traffic on wired and wireless networks. It helps network administrators, security analysts, developers, and students investigate what devices send, where a connection stalls, or how a protocol exchange is structured.

Inspect packet conversations

The packet list gives each frame a summary, while the details pane expands protocol fields and the bytes pane shows the underlying data. This layered view helps connect a high-level event, such as a DNS lookup or TCP retransmission, to the fields and bytes that make it up. Wireshark can dissect a broad range of protocols, with available fields depending on the protocols and capture data involved.

Narrow a capture without losing context

Capture filters limit which packets are collected, which can reduce the size of a live capture. Display filters work later: they hide packets that do not match while keeping the original capture intact. You can build filters around protocols, field values, and logical expressions, then reuse them to focus on a particular host, request, or error.

Capture, replay, and follow streams

Wireshark can capture from one or more interfaces, show decoded packets while a capture runs, and rotate long captures across files. It can also open saved traces from Wireshark and other packet capture tools. Follow Stream gathers related TCP or UDP traffic into a conversation view, which is useful when investigating an exchange across many packets.

Compare traffic and inspect patterns

Statistics views summarize a capture by protocol, endpoint, conversation, or other dimensions. Packet coloring can make matching traffic easier to spot, and the application includes analysis tools for areas such as telephony and wireless traffic. These views help narrow an investigation, but they do not replace understanding where the capture was taken and what the protocol should be doing.

When another tool fits better

TShark, included with Wireshark, suits command-line capture, batch analysis, and scripts that do not need a graphical interface. Termshark provides a terminal interface for people who want interactive packet inspection over SSH or in a console. For capture-first command-line work, tcpdump is a smaller, focused option; its capture files can then be opened in Wireshark for deeper inspection.