What it does
Wireshark analyzes live or saved packet captures and provides protocol dissection, filters and several views of network conversations.
Open a saved capture for offline analysis, or select a capture interface for live traffic. Wireshark dissects protocol fields and applies display filters; capture filters instead limit what is collected. Long captures can rotate through a fixed set of files, and analysis output can be exported to formats including CSV, XML and plain text. Live capture may need special privileges, and the interface and capture location determine which traffic is visible. It cannot infer every exchange elsewhere on the network from one computer’s view. The full application is free GPLv2 software on supported Windows, macOS and UNIX-family systems.
Strengths
- Live capture and offline analysis
- Detailed protocol inspection
Best for
- Investigating protocol behavior in packet captures
Sources
- Wireshark • Go Deep | About (Oct 26, 2026)
- Wireshark FAQ (Oct 26, 2026)
- Capturing Live Network Data (Oct 26, 2026)
- Capture Prerequisites (Oct 26, 2026)