Wireshark
Wireshark
Wireshark is a free and open-source network protocol analyzer. It allows users to capture and interactively browse the traffic running on a computer network. It is widely used for network troubleshooting, analysis, software and protocol development, and education. Wireshark runs on most modern operating systems, including Linux, macOS, and Windows.
Originally named Ethereal, the project was started by Gerald Combs in 1998. In 2006, due to trademark issues with the name "Ethereal", the project was renamed to Wireshark. The core library behind the packet capture is known as libpcap (or WinPcap/Npcap on Windows).
Features
Wireshark provides a rich set of features for network analysis:
- Deep inspection of hundreds of protocols, with more added regularly.
- Live capture and offline analysis.
- Standard three-pane packet browser.
- Powerful display filters that allow precise selection of packets.
- Support for reading and writing many capture file formats, including pcap, pcapng, and others.
- Decryption support for common protocols such as IPsec, SSL/TLS, and WPA2.
- Capability to capture from multiple network interfaces simultaneously.
- Extensibility via Lua scripting and plugin APIs.
- A companion command-line tool, tshark, for batch processing and scripting.
History
The development of Wireshark began in 1998 under the name Ethereal. It was originally intended to fill the need for a capable, free network protocol analyzer on Linux. The first public release appeared later that year. In 2006, when Gerald Combs left his employer and the trademark for Ethereal was held by that company, the project was relaunched as Wireshark. The core team and community migrated to the new name, while the old Ethereal codebase was discontinued. Since then, Wireshark has become the de facto standard for packet analysis in many industries. It is released under the GNU General Public License (GPL).