Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what"s going on inside a network cable, just like a voltmeter is used by an electrician to examine what"s going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.
- Deep inspection of hundreds of protocols, with more being added all the time
- Live capture and offline analysis
- Standard three-pane packet browser
- Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
- Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
- The most powerful display filters in the industry
- Rich VoIP analysis
- Read/write many different capture file formats
- Capture files compressed with gzip can be decompressed on the fly
- Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
- Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
- Coloring rules can be applied to the packet list for quick, intuitive analysis
- Output can be exported to XML, PostScript®, CSV, or plain text
New and Updated Features in version 2.4.0:
- Experimental 32-bit and 64-bit Windows Installer (.msi) packages are available. It is recommended that you use these independently of the NSIS (.exe) installers. That is, you should make sure the NSIS package is completely uninstalled before installing the Windows Installer package and vice-versa.
- Source packages are now compressed using xz instead of bzip2.
- The legacy (GTK+) UI is disabled by default in the Windows installers.
- The legacy (GTK+) UI is disabled by default in the development environment (Autotools and CMake).
- SS7 Point Codes can now be resolved into names with a hosts-like file.
- Wireshark can now go fullscreen to have more room for packets.
- TShark can now export objects like the other GUI interfaces.
- Support for G.722 and G.726 codecs in the RTP Player (via the SpanDSP library).
- You can now choose the output device when playing RTP streams.
- Added support for dissectors to include a unit name natively in their hf field. A field can now automatically append "seconds" or "ms" to its value without additional printf-style APIs.
- The Default profile can now be reset to default values.
- You can move back and forth in the selection history in the Qt UI.
- IEEE 802.15.4 dissector now uses an UAT for decryption keys. The original decryption key preference has been obsoleted.
- Extcap utilities can now provide configuration for a GUI interface toolbar to control the extcap utility while capturing.
- Extcap utilities can now validate the capture filter.
- Display filter function len() can now be used on all string and byte fields.
- Added an experimental timeline view for 802.11 wireless packet data which can be enabled via the "802.11 radio information" preferences.
- Added TLS 1.3 (draft 21) dissection and decryption support (Bug 12779).
- The (D)TLS Application Layer protocol (e.g. HTTP or CoAP) can now be changed via the Decode As dialog.
- The RSA keys dialog for SSL keys has improved feedback for invalid settings and no longer requires the IP address, Port or Protocol fields to be set in addition to the Key File.
- TCP Analysis will detect and flag more spurious retransmissions. [full release notes]
Download: Wireshark 2.4.0 | Wireshark 64-bit | ~50.0 MB (Open Source)
Download: Portable Wireshark 2.4.0
View: Wireshark Website