What makes WireShark a particularly invaluable tool is its filters. And the output can be exported to XML, PostScript®, CSV, or plain text.įilters make traffic capture and analysis easier And whether you’re dealing with tcpdump (libpcap) and Pcap NG or Cisco Secure IDS iplog and Microsoft Network Monitor, WireShark can help as it reads and writes many capture file formats.Īlso, it reads live data from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and other sources. Captured data stored for offline analysis can be browsed via a GUI, or via the TTY-mode TShark utility.įurthermore, the tool runs on many operating systems, such as Windows, OS X, Linux distros, FreeBSD, OpenBSD, and NetBSD. It supports over two thousand network protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2.

WireShark’s strength lies in its rich set of features. Support for multiple protocols and operating systems And although users have to be mindful of occasional security vulnerabilities WireShark may create, a range of capabilities and huge community support make this network analyzer one of the best in its class. It’s the de facto standard across many commercial, governmental, and non-profit organizations. Started by Gerald Combs in 1998, this open-source tool allows you to find out the composition, amount, and latency of network traffic. To that end, WireShark can be of great help. Having a detailed view of the data packets crossing your network makes it easier to determine its security performance.

Wireshark capture filter subnet