That makes it easier to understand what happened on the network instead of guessing. Learn how to choose an interface, start a live capture, and inspect the traffic that appears in real time. Build practical packet analysis and troubleshooting knowledge that supports networking and infrastructure career growth. It can also support people exploring network engineering careers and building stronger troubleshooting skills. This site is built for people who want to understand packet captures, protocol behavior, and real network traffic in a clearer, more practical way.

• TCP segments that start with the middle of a Yahoo Messenger packet that takes more than one TCP segment will not be recognized as Yahoo Messenger packets (even if the TCP segment also contains the beginning of another Yahoo Messenger packet).
• As of Wireshark 0.8.16, such a mechanism exists; if you select a UDP or TCP packet, the right mouse button menu will have a “Decode As…​” menu item, which will pop up a dialog box letting you specify that the source port, the destination port, or both the source and destination ports of the packet should be dissected as some particular protocol.
• The third panel in the Wireshark UI shows the raw data of a packet in hexadecimal and ASCII format for further analysis.
• More advanced setups may use managed switches, mirror ports, or dedicated capture devices.
• If this occurs, please let the Wireshark developers know at wireshark-; be sure to send us a copy of that trace file if it’s small and contains non-sensitive data.
• If not, this may just be a problem with promiscuous sniffing, either due to running on a switched network or a dual-speed hub, or due to problems with the interface not supporting promiscuous mode; see the response to this earlier question.
• If it does, you should ask whoever supplied the driver for the interface (the vendor, or the supplier of the OS you’re running on your machine) whether it supports promiscuous mode with that network interface.

Continue Reading About Wireshark

Note also that on the Linksys Web site, they say that their auto-sensing hubs “broadcast the 10Mb packets to the port that operate at 10Mb only and broadcast the 100Mb packets to the ports that operate at 100Mb only”, which would indicate that if you sniff on a 10Mb port, you will not see traffic coming sent to a 100Mb port, and vice versa. This might be because the interface on which you’re capturing is plugged into an Ethernet or Token Ring switch; on a switched network, unicast traffic between two ports will not necessarily appear on other ports – only broadcast and multicast traffic will be sent to all ports. There is probably an OS, driver, or, for Windows, Npcap bug that causes the system to crash when this happens; see the previous question. Both of those operations cause Wireshark to try to build a list of the interfaces that it can open; it does so by getting a list of interfaces and trying to open them. If this is happening on Linux, it’s likely due to missing development library packages.
A network protocol analyzer, also referred to as a packet sniffer informally, is used to capture and analyze packets on a network to troubleshoot network behavior for bottlenecks, anomalous performance, and security threats. Wireshark is a leading open source network protocol analyzer that security analysts, network admins, and developers can use to capture and analyze network traffic to improve performance or detect security vulnerabilities. Is your security program benefiting from the full potential of open source innovation? It was released in 2025 and donated to the Wireshark Foundation to build on Wireshark’s legacy. Stratoshark is an open source companion tool for Wireshark that shares the same UI, dissection engine, and filtering code, making it easier for Wireshark users to pick up and learn it quickly. Before running a session, users can also select a capture filter, such as traffic to a single host, port 80 traffic, or TCP.
Users can apply filters to view specific streams of data or analyze how different devices communicate. The third panel in the Wireshark UI shows the raw data of a packet in hexadecimal and ASCII format for further analysis. The tool breaks down the packet into layers in OSI or TCP/IP layers and can be expanded into fields showing ports, flags, TTL values, and more. Wireshark UI consists of three different panes that display data from captured packets.
This is really the same question as a previous one; see the response to that question. If not, then see the main Npcap page – check the “Patches, Bug Reports, Questions, Suggestions, etc” section. If you disable network address-to-name translation – for example, by turning off the “Enable network name resolution” option in the “Capture Options” dialog box for starting a network capture – the lookups of the address won’t be done, which may speed up the process of reading the capture file after the capture is stopped. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you’re using are necessary, if any, to support capturing the FCS of a frame. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you’re using are necessary, if any, to support capturing those packets.
Packet Details, the middle pane, shows you as much readable information about the packet as possible, depending on the packet type. When you click on a packet, the other two panes change to show you the details about the selected packet. The Packet List, the top pane, lists all the packets in the capture. Wireshark shows you three different panes for inspecting packet data. Once select the network interface, you can start the capture, and there are several ways to do that. Wireshark is probably already installed because it’s part of the basic package.

What’s Changed

If the packets don’t match the filter, Wireshark won’t save them. Some of the best features of Wireshark are the capture filters and display filters. The bottom pane, Packet Bytes, displays the packet exactly as it was captured in hexadecimal.
Or, if your system has the “script” command installed, you can save a shell session, including telnet, to a file. You can telnet to the router and start a dump session with snoop dump. If this occurs, please let the Wireshark developers know at wireshark-; be sure to send us a copy of that trace file if it’s small and contains non-sensitive data. If a partial packet is saved at the end, Wireshark will complain when reading that file, but you will be able to read all other packets. Through experimentation it appears that sending a HUP signal to that iptrace daemon causes a graceful shutdown and a complete packet is written to the trace file. The iptrace command starts a daemon which you must kill in order to stop the trace.

Capture Filters

Install Wireshark safely and get set up for packet capture and network troubleshooting. Learn how packets move across networks, how protocols like DNS, TCP, HTTP, and TLS operate, and how packet captures are used to diagnose real-world network problems. Streamline your data collection and vendor risk assessments with UpGuard’s SIG Lite risk-mapped questionnaire.

How Packet Analysis Works

Those commands download and update the package, and add user privileges to run Wireshark. Wireshark can be used to understand how communication takes place across a network and to analyze what went wrong when an issue in communication arises. The filters in Wireshark are one of the primary reasons it has become the standard tool for packet analysis.
At least on x86-based machines, Linux can get high-resolution time stamps on newer processors with the Time Stamp Counter (TSC) register; for example, Intel x86 processors, starting with the Pentium Pro, and including all x86 processors since then, have had a TSC, and other vendors probably added the TSC at some point to their families of x86 processors. This is really the same question as the previous one; see the response to that question. In your mail, please give full details of the problem, as described above, and also indicate that the problem occurs with tcpdump not just with Wireshark. If you can capture on the interface with tcpdump, send mail to email protected giving full details of the problem, including If you are having trouble capturing on a particular network interface, and you’ve made sure that (on platforms that require it) you’ve arranged that packet capture support is present, as per the above, first try capturing on that device with tcpdump. You may need to run Wireshark from an account with sufficient privileges to capture packets, such as the super-user account, or may need to give your account sufficient privileges to capture packets.

• You should only use Wireshark on networks where you have permission to inspect network packets.
• If the bug is produced by a particular trace file, please be sure to attach to the bug a trace file along with your bug description.
• Wireshark is cross-platform, using the Qt widget toolkit in current releases to implement its user interface, and using pcap to capture packets; it runs on Linux, macOS, BSD, Solaris, some other Unix-like operating systems, and Microsoft Windows.
• Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developers’ doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to OpenBSD 3.6.
• You can telnet to the router and start a dump session with snoop dump.

Wireshark can be used to examine the details of traffic at a variety of levels, ranging from connection-level information to the bits constituting a single packet. Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline. TCP segments that start with the middle of a Yahoo Messenger packet that takes more than one TCP segment will not be recognized as Yahoo Messenger packets (even if the TCP segment also contains the beginning of another Yahoo Messenger packet). As of Wireshark 0.8.16, such a mechanism exists; if you select a UDP or TCP packet, the right mouse button menu will have a “Decode As…​” menu item, which will pop up a dialog box letting you specify that the source port, the destination port, or both the source and destination ports of the packet should be dissected as some particular protocol. If there’s RTSP traffic that sets up an RTP session, then, at least in some cases, the RTSP dissector will set things up so that subsequent RTP traffic will be identified.

1.2. Features

For example, an alternative is to run tcpdump or the dumpcap utility that comes with Wireshark with superuser privileges to capture packets into a file, and later analyze the packets by running Wireshark with restricted privileges. Wireshark is a data capturing program that “understands” the structure (encapsulation) of different networking protocols. Wireshark is cross-platform, using the Qt widget toolkit in current releases to implement its user interface, and using pcap to capture packets; it runs on Linux, macOS, BSD, Solaris, some other Unix-like operating systems, and Microsoft Windows. You can narrow the view using display filters, making it easier to inspect specific conversations or protocols. Any single frame selected in the top pane is further explained in the tool’s middle panel.
Wireshark uses pcap to capture packets, so it can only capture packets on the types of networks that pcap supports. Wireshark is an open-source network protocol analysis software program, widely considered the industry standard. It is used by cybersecurity professionals, system administrators, and developers, as well as by students who want to understand how digital communications work on a technical level. More advanced setups may use managed switches, mirror ports, or dedicated capture devices. You do not need to be an expert to begin, but learning networking fundamentals will make packet captures easier to understand. A basic understanding of IP addresses, ports, protocols, and how devices communicate on a network is helpful.
Explore skills, tools, and career paths for people building practical networking and infrastructure knowledge. Packet analysis is legal when performed on networks you own or have explicit permission to analyze. Once you understand the layout, it becomes much easier to follow DNS lookups, TCP connections, encrypted sessions, and other traffic behavior.

A default set of rules is provided; users can change existing rules for coloring packets, add new rules, or remove rules. Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developers’ doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to OpenBSD 3.6. Wireshark can also be used to analyze network traffic in cybersecurity research, including simulated attack traffic.