Wireshark
Version: 1.0.6
File Size:
License: GPL
Platforms: Windows/Linux/OSX
URL: http://www.wireshark.org/
Wireshark is a free network packet sniffer computer application. It is used for network troubleshooting, analysis, software and communications protocol development, and education. In June 2006 the project was renamed from Ethereal due to trademark issues
Wireshark is software that “understands” the structure of different networking protocols. Thus, it is able to display the encapsulation and the fields along with their meanings of different packets specified by different networking protocols.
Data can be captured “from the wire” from a live network connection or read from a file that records the already-captured packets.
Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, tshark.
Captured files can be programmatically edited or converted via command-line switches to the “editcap” program.
Display filters can also be used to selectively highlight and color packet summary information.
Data display can be refined using a display filter.
Hundreds of protocols can be dissected.
Wireshark’s native network trace file format is the libpcap format supported by libpcap and WinPcap, so it can read capture files from applications such as tcpdump and CA NetMaster that use that format. It can also read captures from other network analyzers, such as snoop, Network General’s Sniffer, and Microsoft Network Monitor.