What Is Wireshark?

Date First Published: 7th May 2022

Topic: Computer Networking

Subtopic: Network Software

Article Type: Computer Terms & Definitions

Difficulty: Medium

Difficulty Level: 6/10

CONTENTS

Compatibility
Features Of Wireshark

Learn more about what wireshark is in this article.

Wireshark, originally called Ethereal, is a free program used to analyse the data packets and browse the traffic that is flowing across a network. It was developed in 1997 by Gerald Combez and released in 1998. Wireshark is often used for network monitoring, troubleshooting, and demonstrating encapsulation and analysing the structure of different network protocols. Wireshark is written in C++ and Lua.

Wireshark has similar features to tcpdump in that it displays packets being sent or received across a network. However, Wireshark supports a graphical user interface, making it much easier to use, since it eliminates the need for users to remember commands. In addition, it has information filtering functionality, giving the user permission to see all of the traffic that is being passed over a network.

Wireshark is used because:

It can be used to identify security issues.
It can be used to debug software that communicates on a network.
It can be useful software to have an understanding of how traffic is sent over a network as well as understanding the structure of different network protocols.

Compatibility

Wireshark is compatible with Windows 11, 10, 8.1 and 8. The latest version of Wireshark that is compatible with Windows 7 is 3.2, Windows Vista as new as 2.2, and Windows Server 2003 as new as 1.12. Wireshark is also compatible with Linux, macOS, BSD, Solaris, and other Unix-like operating systems.

Note:

There is a terminal-based version of Wireshark that does not use a graphical user interface and requires users to type commands called Tshark.

Features Of Wireshark

The key features of Wireshark are:

Support for live data reading and analysis over a range of networks, such as Ethernet, point-to-point protocol, loopback, and IEEE 802.11.
Display filters to filter and organise the display of data.
Raw USB traffic can be captured when using Linux.
Plug-ins can be created for the purpose of inspecting new protocols.
Support for the capture of VoIP calls.
Captured data can be browsed using a graphical user interface or the terminal-based version of Wireshark, called Tshark.
Providing detailed information about packet data.