Protocol Analysis at Your Fingertips
Wireshark is a layer-2 through layer-7 protocol analyzer that captures and visualizes network traffic in real time. It provides unprecedented insight into network communications, making it an essential tool for network professionals, security experts, and developers alike.
As a passive tool, Wireshark doesn't generate or alter traffic but reveals everything happening on the wire or air, including plaintext credentials, malware beacons, misconfigured devices, and attacks in progress.
Key Features
Packet Capture
Capture live traffic via libpcap/Npcap across Ethernet, Wi-Fi, Bluetooth, USB, and virtual interfaces with promiscuous and monitor mode support.
Protocol Dissection
Over 2,400 protocol dissectors parse traffic into human-readable format, handling fragmentation, encryption (with keys), and tunneling protocols.
Powerful Filtering
Capture and display filters enable precise traffic analysis, with conversation views, flow graphs, and follow stream functionality.
CLI Tools
TShark, dumpcap, editcap, mergecap, and capinfos provide command-line alternatives for capture, analysis, and PCAP manipulation.
Scripting Support
Lua scripting enables custom dissectors and automation. Export formats include PCAP, PCAPNG, JSON, CSV, and XML.
Security Analysis
Detect anomalies, malware communications, reconnaissance activities, and attacks in progress through comprehensive protocol analysis.