Provide in-depth information and explanation of packet data.Import and analyze hex dumps of packet data.Read capture files created by tcpdump/WinDump for analysis.Capture live network traffic data and save it for offline analysis.Wireshark uses the pcap API (libpcap, or Npcap on Windows 7+) to retrieve packets. The fields and their data can be viewed, as defined by the protocols. Wireshark can parse the structure of multiple network protocols ( encapsulation). Ethereal changed its name to Wireshark in 2006 because of trademark issues. Originally known as Ethereal, Gerald Combez began developing Wireshark in 1997, and it was released later in 1998 with some instability. The ability of the average user to monitor and analyze network traffic increased significantly with Wireshark's emergence.īelow is an example of Wireshark capturing live data.

In the past, such instruments were either very pricey, restrictively patented, or both. It features a plug-in system, so users can create new Wireshark features for others to use.Ī network packet analyzer helps discover what happens inside of a network cable, like a powertrain uses a voltmeter to check what takes place inside an electric wire. Wireshark is an open-source project licensed under the GPL ( GNU Public License), which means users can run it on multiple computers free of charge and can view or modify the source code.

Packet sniffing is primarily used for legitimate purposes such as network troubleshooting or traffic monitoring.

Wireshark is a network packet analyzer used for capturing ( sniffing) packets flowing across a computer network in addition to those that are moving to and from your computer.

Wireshark uses for security