- Home
- Network Protocol Analyzers
- Wireshark
Wireshark
What it is
Wireshark is free, open-source software for capturing and interactively examining network traffic. It offers live capture and offline analysis through a graphical interface and the TShark terminal utility, with deep inspection of hundreds of protocols. Display filters narrow displayed traffic, while capture filters use different syntax. Wireshark reads and writes formats such as pcap and pcapng and can decompress gzip-compressed captures while opening them. Analysis tools include VoIP analysis, packet-coloring rules, and export to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software runs on Linux, macOS, and Windows under GNU General Public License version 2, with no license fee. Windows packages include Npcap for live packet capture. Available traffic depends on the operating system, capture library, interface, and network configuration.
For and against
For
- Captures live traffic and analyzes saved files
- Inspects hundreds of network protocols
- Supports pcap and pcapng formats
- Provides graphical and TShark interfaces
- Offers protocol decryption options
Against
- Visible traffic depends on network configuration
- Windows live capture requires Npcap
- Display and capture filters use different syntax
- Switched networks may hide other-port unicast traffic
The verdict
Wireshark combines broad protocol inspection with live, offline, graphical, and command-line analysis at no license fee. Capture visibility and the Windows Npcap requirement are important operational considerations.
Who it suits
Wireshark suits network professionals, security experts, developers, and educators who need protocol inspection or packet analysis. It is also useful when both live captures and saved capture files must be examined.
Plans and prices
Wireshark
no license keys or fees · use on any number of computers · GPL source available
Read 15 Oct 2026 · wireshark.org
On the record
- Analysis features
- Features include VoIP analysis, packet coloring rules, and export to XML, PostScript, CSV, or plain text.wireshark.org · read 29 Sep 2026
- API
- The sharkd daemon exposes JSON-RPC over standard input or Unix/TCP sockets for programmatic packet dissection, filtering and analysis.wireshark.org · read 15 Oct 2026
- API methods
- Sharkd documents methods for loading captures, listing frames and fields, compiling filters, following streams, retrieving statistics and setting preferences.wireshark.org · read 15 Oct 2026
- Capture and analysis
- It supports live capture and offline analysis, with a graphical interface and the TShark terminal utility.wireshark.org · read 29 Sep 2026
- Capture dependency
- The Windows packages include Npcap, which is required for live packet capture.wireshark.org · read 29 Sep 2026
- Capture-file export
- It saves captures and exports all or selected packets in multiple capture formats.wireshark.org · read 15 Oct 2026
- Capture-file import
- It opens packet files produced by tcpdump, WinDump, Wireshark and other capture programs, and can import hexadecimal dumps.wireshark.org · read 15 Oct 2026
- Capture limitation
- The traffic visible to Wireshark depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports.wireshark.org · read 29 Sep 2026
- Company facts
- LinkedIn describes the Wireshark Foundation as a San Francisco nonprofit in computer and network security with a stated company size of 2–10 employees.linkedin.com · read 15 Oct 2026
- Decryption
- Documented supported decryption covers protocols including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP and WPA/WPA2.g2.com · read 15 Oct 2026
- Documentation
- Official material includes a User’s Guide, Developer’s Guide, wiki, FAQ, Q&A site, issue tracker and user/developer mailing lists.wireshark.org · read 15 Oct 2026
- Extensibility
- The extcap interface lets external binaries or scripts appear as capture interfaces and be configured through the GUI.wireshark.org · read 15 Oct 2026
- File formats
- It reads and writes many capture formats, including pcap and pcapng, and can decompress gzip-compressed capture files on the fly.wireshark.org · read 29 Sep 2026
- Filtering
- Users can filter packets using many criteria, including display filters for addresses, ports and protocols.wireshark.org · read 15 Oct 2026
- Foundation
- Since 2023 the project has been operated by the Wireshark Foundation, a U.S. 501(c)(3) nonprofit that provides infrastructure, hosts SharkFest and promotes network education.wireshark.org · read 15 Oct 2026
- History
- Gerald Combs began Ethereal in late 1997; its first public release was July 1998, and the project adopted the Wireshark name in 2006.wireshark.org · read 15 Oct 2026
- Licence
- Wireshark is open source under GNU GPL version 2 or later, with source code available for modification and redistribution under the licence.wireshark.org · read 15 Oct 2026
- License
- Wireshark is open-source software released under the GNU General Public License version 2, and the downloaded version is the full version without a license fee.wireshark.org · read 29 Sep 2026
