• Available for UNIX and Windows.
• Capture live packet data from a network interface.
• Open files containing packet data captured with tcpdump/WinDump, Wireshark, and many other packet capture programs.
• Import packets from text files containing hex dumps of packet data.
• Display packets with very detailed protocol information.
• Save packet data captured.
• Export some or all packets in a number of capture file formats.
• Filter packets on many criteria.
• Search for packets on many criteria.
• Colorize packet display based on filters.
• Create various statistics.

Wireshark is the most often-used packet sniffer in the world. Like any other packet sniffer, Wireshark does three things:

1. Packet Capture : Wireshark listens to a network connection in real time and then grabs entire streams of traffic – quite possibly tens of thousands of packets at a time.
2. Filtering : Wireshark is capable of slicing and dicing all of this random live data using filters. By applying a filter, you can obtain just the information you need to see.
3. Visualization : Wireshark, like any good packet sniffer, allows you to dive right into the very middle of a network packet. It also allows you to visualize entire conversations and network streams.

• Network Troubleshooting : Helps diagnose network issues by analyzing packet data.
• Security Analysis : Assists in detecting malicious activity and security vulnerabilities.
• Protocol Development : Useful for developers working on network-related software.
• Learning & Research : Helps students and professionals understand networking concepts.
• Performance Monitoring : Allows administrators to monitor network traffic and optimize performance.

Wireshark is a powerful tool for network analysis and troubleshooting. Here are some examples of its usage :

1. Troubleshooting Network Issues : Wireshark can capture and analyze packets to identify problems like packet loss, latency, or misconfigured devices. For example, you can use filters to isolate TCP retransmissions or high-latency packets.
2. Protocol Analysis : It allows you to examine specific protocols, such as HTTP, FTP, or DNS, to understand their behavior. For instance, you can view full HTTP sessions, including headers and data for requests and responses.
3. Security Analysis : Wireshark can detect anomalies that may indicate malware or unauthorized access. For example, you can filter traffic to find unusual domains or IP addresses.
4. Extracting Files : You can extract files transferred over protocols like HTTP or SMB. For example, you can export objects from HTTP sessions, such as images or executables.
5. Decrypting SSL/TLS Traffic : With the right decryption keys, Wireshark can analyze encrypted traffic to troubleshoot secure communications.
6. Examining DHCP Traffic : It can help diagnose DHCP issues by analyzing client broadcasts, server offers, and acknowledgments.

These examples showcase the versatility of Wireshark in network management and security.

• libwireshark17
• libwiretap-dev
• libwsutil-dev

Terminal Installation Commands ...
GUI Installation Steps ...

Linux

1. Update your package list (recommended before installing new software) :

$ sudo apt update && sudo apt upgrade # For Debian-based systems (Ubuntu, Debian)

$ sudo dnf update # For RHEL-based systems (Fedora, CentOS)

2. Install Wireshark :
• Ubuntu/Debian : sudo apt install wireshark
• Fedora/RHEL/CentOS : sudo dnf install wireshark
• Arch Linux : sudo pacman -S wireshark-gtk
3. Grant permissions (if needed) : sudo usermod -aG wireshark $USER
4. Launch Wireshark : wireshark

Or find it in your applications menu.

Windows

1. Download Wireshark : Head over to the official Wireshark website and download the latest version for Windows.
2. Run the Installer : Locate the downloaded .exe file and double-click to start the installation.
3. Select Components : The installer will prompt you to choose components. The default settings are recommended, but you can customize them if needed.
4. Install Npcap : Wireshark requires Npcap for packet capturing. The installer will include an option to install it.
5. Choose Install Location : By default, Wireshark installs in C:\Program Files\Wireshark, but you can change this if necessary.
6. Complete Installation : Click “Install” and wait for the process to finish. Once done, launch Wireshark from the Start menu or desktop shortcut.

MacOS

1. Download Wireshark : Visit the official Wireshark website and download the macOS package.
2. Open the Disk Image (.dmg) : Once downloaded, open the .dmg file.
3. Drag Wireshark to Applications : Move the Wireshark application to the /Applications folder.
4. Install ChmodBPF : To capture packets, install the ChmodBPF launch daemon by opening the Install ChmodBPF.pkg file in the .dmg.
5. Launch Wireshark : Open Wireshark from the Applications folder and start analyzing network traffic.

Terminal Uninstallation Commands ...
GUI Uninstallation Steps ...

Linux

1. Remove Wireshark :
• Ubuntu/Debian : sudo apt remove --purge wireshark
• Fedora/RHEL/CentOS : sudo dnf remove wireshark
• Arch Linux : sudo pacman -R wireshark-gtk
2. Remove configuration files (optional) : rm -rf ~/.wireshark

Windows

1. Open Control Panel : Go to Control Panel > Programs > Programs and Features.
2. Find Wireshark : Scroll through the list and locate Wireshark.
3. Uninstall : Right-click on Wireshark and select “Uninstall.” Follow the prompts to remove the software.
4. Remove Npcap (Optional) : If you installed Npcap, you may want to uninstall it separately using the same method.

MacOS

1. Remove the Application : Go to /Applications and delete the Wireshark app.
2. Remove ChmodBPF : If installed, remove the ChmodBPF daemon by deleting related files from /Library/LaunchDaemons/.
3. Clear Configuration Files : Delete any remaining Wireshark preferences from ~/Library/Application Support/Wireshark/.