New protocols can be scrutinized by creating plug-ins.

Display packets with very detailed protocol information.

Display filters are used to filter and organize the data display.

Importpackets from text files containing hex dumps of packet data.

Open files containing packet data captured (PCAP Files) with tcpdump/WinDump, Wireshark, and many other packet capture programs.

Capture live packet data from a network interface.

The following are the features that Wireshark provides: IT also has terminal-based free software versions like Tshark. Wireshark shares many characteristics with tcpdump only the difference is that it supports a graphical user interface (GUI) and has information filtering features. Wireshark can be operated in different platforms such as Windows, Unix, Linux and employs the GTK+ widget toolkit or PCAP for packet capturing. It is used to analyze the structure of different network protocols and has the ability to demonstrate application. It is an essential tool for security professionals or system administrators.

Wireshark is an open-source widely used network packet or protocol analyzer.

Just Because it can drill down and read the contents of each packet, it’s used to troubleshoot network problems and test software. Wireshark is an open-source application and it is the world’s foremost and widely-used network protocol analyzer that lets you see what’s happening on your network at a microscopic level.

Wireshark filters cheat sheet pdf