Wireshark

Wireshark is a free, open-source network protocol analyzer that is used for network troubleshooting, analysis, software and protocol development, and education.

Some of the main features of this program include the following:

- There are two ways that data can be captured with this program. The first is "from the wire", which means that the data comes from a live network connection. The second is from a file of already-captured packets.

One key benefit of using this program is that it is completely free to use.

- There are multiple types of networks that data can be read from. These include Ethernet, IEEE 802.11, PPP, and loopback.

- Captured network data can be browsed in the graphical interface or with TShark, the terminal (command-line) version of the program.

- Using command-line switches, capture files can be programmatically edited or converted with the editcap program.

- Using a display filter, the data can be refined so that only the relevant packets are shown.

- Dissectors for new protocols can be created and added as plug-ins.

- VoIP calls in the captured traffic can be detected and, if the encoded data uses a compatible encoding, even played back.

- Raw USB traffic can be captured as well.

- Wireless connections can be filtered as long as they traverse the monitored Ethernet.

- Capture options such as capture filters, ring buffers and timers that stop a capture after a set time help control the output of the captured traffic.

- The Wireshark interface does not need to run with elevated privileges; on Windows, packet capture is handled by the Npcap driver, which limits the damage a bug in a protocol dissector could do.

- Coloring rules highlight packets according to their fields, which helps identify the different types of traffic at a glance.

- The program can also be used to read packets captured with network simulation tools.

Wireshark runs on Microsoft Windows, Linux, macOS, BSD, Solaris and some other Unix-like operating systems. There is also a terminal-based version called TShark. These programs are free software released under the terms of the GNU General Public License version 2. Current Windows builds need 64-bit Windows 10 or 11, and development is supported by the non-profit Wireshark Foundation.