Wireshark

Overview

Wireshark is a desktop tool for capturing network traffic and examining packets interactively. It is best suited to network professionals, security experts, developers and educators who need detailed protocol-level visibility. Its breadth and full-featured interface make it a strong free analyzer, provided the network and capture setup expose the traffic you need.

The project dates to 1998 and is open source under GNU GPL version 2. Its graphical interface serves interactive investigation, while TShark offers a terminal-based way to work with captures. Neither can reveal traffic that the operating system, capture library, interface or network configuration does not make visible; on switched networks, unicast traffic between other ports may remain out of reach.

Browse Network Protocol Analyzers, Network Packet Capture Software and Network Packet Analyzer Software.

Key features

• Broad protocol inspection: Wireshark can dissect hundreds of protocols, making it useful when an investigation spans more than one type of network traffic.
• Live and offline analysis: Capture traffic as it moves or inspect saved captures later; remote capture is supported too. Offline analysis is the practical fallback when live visibility or access is limited.
• Two filtering syntaxes: Display filters narrow packets shown during analysis, but their syntax differs from capture filters. Users need to keep the distinction straight when choosing what to capture versus what to inspect.
• Flexible capture files: It reads and writes formats including pcap and pcapng, and decompresses gzip-compressed capture files on the fly. That helps when working across different capture sources and stored archives.
• Focused analysis tools: VoIP analysis, packet-coloring rules and export to XML, PostScript, CSV or plain text support different investigation and reporting needs.
• Decryption support: It can decrypt protocols including IPsec, Kerberos, SSL/TLS, WEP and WPA/WPA2. This expands analysis possibilities, though useful visibility still depends on the capture and network setup.
• Graphical and terminal workflows: Wireshark pairs its interactive graphical interface with TShark, a command-line utility. That gives users a choice between visual packet browsing and terminal-based work.

Pricing

Wireshark costs free. The free plan is the full version, with no license fee, rather than a time-limited trial or a reduced tier. That makes it a practical choice for individuals and teams who need its complete analyzer without a software license charge.

There is no paid plan to trade off against the free edition. The GNU GPL version 2 governs the open-source release. Windows packages include Npcap, which is required for live packet capture; capture permissions and visibility still depend on system and network conditions.

Platforms

Wireshark is available for Linux, macOS and Windows as desktop software. Its capture and analysis capabilities include PCAP support, command-line tools, remote capture, flow analysis and traffic decryption. On Windows, Npcap is needed for live capture and is included in the packages.

Who it's for

Network professionals and security experts can use Wireshark to inspect protocol behavior and investigate captured traffic. Developers and educators can use the same packet-level detail to examine network exchanges or teach how protocols operate. It is less suitable when a reader expects a tool to expose all traffic on a switched network automatically: visibility is constrained by the interface, capture library, operating system and network configuration.

Support comes through the community Q&A site and Wireshark users mailing list. The download page also links security advisories, including notices about dissector crashes and other vulnerabilities, so users can follow project security updates.

Pros and cons

• Pro: Full-featured use without a license fee. The free download includes the full version, not a limited free tier.
• Pro: Broad inspection and file support. Hundreds of protocols, common capture formats and gzip decompression make it adaptable to varied analysis work.
• Pro: Multiple ways to work with traffic. Live and remote capture, offline analysis, a GUI and TShark cover both interactive and terminal workflows.
• Con: Capture visibility is conditional. Hardware, operating system and network configuration can limit what packets appear; switched networks may hide other ports' unicast traffic.
• Con: Filtering requires care. Capture-filter and display-filter syntax differ, adding a distinction users must learn to avoid applying the wrong filter.
• Con: Windows live capture has a dependency. Npcap is required, even though it is included in the Windows packages.

Alternatives

Choose TShark when a free option on Linux, macOS or Windows better fits a terminal-centered workflow. Consider NETCAP if you want a freemium alternative with an open-source CLI and a free Core plan.

Malcolm is another free option for Linux, macOS, Windows, web or self-hosted use. tcpdump is a free, BSD-licensed choice for capture, with permissions dependent on the operating system and configuration. Zui is free to download and use across Linux, macOS and Windows.

PacketSafari offers a freemium alternative across desktop, web, API and self-hosted platforms. Arkime is a free, open-source option for API, Linux, self-hosted and web environments, with no paid-only features or license fees. NetworkMiner is a freemium alternative for Linux, macOS and Windows; its source code is GPLv2 free and open source.

Verdict

Choose Wireshark if you need a capable, no-license-fee desktop analyzer for detailed protocol inspection across live and saved traffic. Its strongest case is the combination of protocol breadth, flexible capture-file handling and both graphical and command-line tools. Look elsewhere if your priority is seeing traffic the network does not expose, or if you need live capture on Windows without the Npcap dependency.