Wireshark is the world's leading network traffic analyzer, and an essential tool for any security professional or systems administrator. This free software lets you analyze network traffic in real time, and is often the best tool for troubleshooting issues on your network.
Common problems that Wireshark can help troubleshoot include dropped packets, latency issues, and malicious activity on your network. It lets you put your network traffic under a microscope, and provides tools to filter and drill down into that traffic, zooming in on the root cause of the problem. Administrators use it to identify faulty network appliances that are dropping packets, latency issues caused by machines routing traffic halfway around the world, and data exfiltration or even hacking attempts against your organization.
Wireshark is a powerful tool that requires sound knowledge of networking basics. For most modern enterprises, that means understanding the TCP/IP stack, how to read and interpret packet headers, and how routing, port forwarding, and DHCP work, for example.
What does Wireshark do?
Wireshark intercepts traffic and converts that binary traffic into human-readable format. This makes it easy to identify what traffic is crossing your network, how much of it, how frequently, how much latency there is between certain hops, and so forth.
While Wireshark supports more than two thousand network protocols, many of them esoteric, uncommon, or old, the modern security professional will find analyzing IP packets to be of most immediate usefulness. The majority of the packets on your network are likely to be TCP, UDP, and ICMP.
Given the large volume of traffic that crosses a typical business network, Wireshark's tools to help you filter that traffic are what make it especially useful. Capture filters will collect only the types of traffic you're interested in, and display filters will help you zoom in on the traffic you want to inspect. The network protocol analyzer provides search tools, including regular expressions and colored highlighting, to make it easy to find what you're looking for.
Sometimes the best way to find anomalous traffic is to capture everything and establish a baseline.
How to use Wireshark
You need to know what is normal to find what is abnormal, and Wireshark includes tools to create baseline statistics. While Wireshark is a network protocol analyzer, and not an intrusion detection system (IDS), it can nevertheless prove extremely useful to zeroing in on malicious traffic once a red flag has been raised.
Wireshark can also be used to intercept and analyze encrypted TLS traffic. Symmetric session keys are stored in the browser, and with the appropriate browser setting (and permission and knowledge of the user) an administrator can load those session keys into Wireshark and examine unencrypted web traffic.
Wireshark comes with graphical tools to visualize the statistics. This makes it easy to spot general trends, and to present findings to less-technical management.
Wireshark as a learning tool
There are so many hands-on uses for Wireshark that it's easy to overlook what an effective learning tool it can be. Lifting up the hood of a car is the best way to understand how an internal combustion engine works, and likewise lifting the lid on network traffic and watching packets fly by — even drilling down to the byte level, and examining TCP headers — is a powerful way to learn, and teach others how the internet works.
Demystifying the motor that runs our information economy can only lead to better-informed business decisions and better government policy, not to mention a better-qualified workforce. Wireshark is already a staple of classroom curricula in many training settings, but the docs are complete enough at this point that an eager learner can easily download the network protocol analyzer, sniff their local wifi access point, and start examining traffic.
History of Wireshark
Wireshark has been around since 1998, when it was invented by Gerald Combs and called Ethereal. Over the years it has received gargantuan amounts of community support and patches, and is widely accepted as the de facto network protocol analyzer available today.
Wireshark runs on all the major and most minor operating systems, including the usual Linux distros, Windows, OS X, FreeBSD, NetBSD, and OpenBSD. The program is free software, licensed GPL, and is thus free to use, share, and modify.
Wireshark tutorial
There are lots of great free resources on how to learn Wireshark, plus tips and tricks to get the most out of the software. Here are a few of our favorites:
- I've Just Downloaded Wireshark… Now What? (PDF)
- Wireshark User's Guide
- How to Use Wireshark: A Complete Tutorial (Lifewire)
- How to Use Wireshark to Capture, Filter and Inspect Packets (How-To Geek)
Wireshark free download
Download this network protocol analyzer at wireshark.org and start sniffing packets today.