Wireshark is the world's most widely used network protocol analyser. It captures traffic from a network interface and displays every packet in detail, decoding hundreds of protocols so you can see exactly what a device sent and received. Network engineers, security analysts and developers use it to troubleshoot connectivity, inspect suspicious traffic, and understand how a protocol behaves on the wire. It is free and open source.
Last updated: 6 August 2026
Wireshark answers the question of what is actually happening on the network. An analyst investigating a slow application captures traffic and sees TCP retransmissions; an incident responder opens a suspicious PCAP and follows a TCP stream to read a plaintext protocol; a developer confirms their client is really sending the header they expect. Display filters let you cut a huge capture down to the exact conversation you care about, and Follow Stream reassembles a session into readable form. It reads traffic but never sends attacks itself.
Linux · Windows · macOS · BSD
Open source (GNU GPLv2)
httpDisplay filter to show only HTTP traffic in a capture.
ip.addr == 10.10.10.5Show only packets to or from a specific host.
tcp.port == 443Filter to a single TCP port, for example HTTPS.
tcp.flags.syn == 1 && tcp.flags.ack == 0Isolate initial TCP SYN packets to spot connection attempts or scans.
Follow > TCP StreamReassemble both sides of a TCP conversation into one readable view.
Statistics > ConversationsSee which endpoints are talking and how much data each exchanged.
dumpcap -i eth0 -w capture.pcapngCapture to disk from the command line with the lightweight capture engine.
Capture traffic only on networks you own or are authorised to monitor. Intercepting other people's communications without consent can violate the IT Act 2000 and privacy law in India. On shared or corporate networks, get written authorisation, and be careful that captures may contain sensitive personal data you must handle lawfully.
On switched networks you only see traffic to and from your own port unless you set up a SPAN/mirror or ARP-based interception. Encrypted traffic (TLS) shows metadata but not plaintext without keys. Large captures are memory-heavy, and Wireshark analyses traffic only; it does not block or alert in real time.
| Tool | Pick it when |
|---|---|
| tcpdump | You need a lightweight command-line capture on a server with no GUI. |
| tshark | You want Wireshark's decoding in a scriptable command-line form. |
| Zeek (Bro) | You want high-level network security monitoring and logs, not per-packet inspection. |
| NetworkMiner | You want forensic extraction of files and credentials from a PCAP. |
| Arkime | You need to index and search very large volumes of full packet captures. |
Ethical Hacking Course (6 months) — network traffic analysis module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000