Wireshark comes with powerful filter engines, Capture Filters and Display Filters, to remove noise from the network or already captured traffic. This article provides an in-depth tutorial that begins with the basics (i.e., filtering, Wireshark network layers, etc.) and takes you into the depth of traffic analysis. Moreover, it will only analyze network protocol/activities and won’t perform any other activity like sending/intercepting packets. It will only help you inspect and identify what is happening on your network. However, Wireshark won’t warn you of any malicious activity.

It includes capture and display filters.

It provides description support for protocols including SSL, WPA/WPA2, IPsec, and many others.

It saves and exports captured packet data in various formats (CSV, XML, plaintext, etc.).

It opens packet files captured by other programs such as Oracle snoop and atmsnoop, Nmap, tcpdump, Microsoft Network Monitor, SNORT, and many others.

It captures packets from various network media, i.e., Wireless LAN, Ethernet, USB, Bluetooth, etc.

Multiplatform: it is available for Unix, Mac, and Window systems.

The Wireshark tool is composed of a rich set of features. Hence, it’s by far one of the best packet analyzer tools and is utilized as a standard commercial tool by various government agencies, educational institutes, and non-profit organizations.

Thanks to the global networking expert’s voluntary contribution, it continues to make updates for new technologies and encryption standards. The Wireshark project was initiated in 1998. Wireshark is the de-facto go-to tool for several network problems that vary from network troubleshooting, security issue examination, inspecting network traffic of a suspicious application, debugging protocol implementations, along with network protocol learning purposes, etc. It requires some sound knowledge of basic networking and is considered an essential tool for system administrators and network security experts. It captures and displays packets in real-time for offline analysis in a human-readable format with microscopic details. Wireshark is an open-source and free network traffic inspection tool.

Brief wireshark tutorial