Wireshark
The world's most widely used open-source network protocol analyser.
What it is
About Wireshark
Wireshark is a free, open-source packet capture and protocol analysis tool used by network engineers, security analysts, and developers to inspect the actual data flowing across a network interface at the packet level. It captures raw network traffic (or opens a pre-captured pcap file) and decodes hundreds of protocols — from TCP/IP and DNS through to application protocols like HTTP, TLS, SIP, and broadcast-specific protocols like ST 2110 RTP — displaying each packet's fields and values in a structured tree. Display filters allow engineers to isolate specific conversations, protocol types, or anomalies from captures containing millions of packets. Wireshark is the definitive tool when a problem cannot be diagnosed from logs or monitoring data alone. Proving whether a TCP handshake is completing, whether DNS is resolving correctly, whether TLS negotiation is failing before the application even starts — all require packet-level visibility. It is used in network troubleshooting, security incident investigation, protocol development, and in broadcast engineering to verify ST 2110 RTP stream characteristics. The underlying capture engine (libpcap/WinPcap) is also used programmatically via tshark (Wireshark's command-line version) in automated analysis pipelines.
What you can do with it
Capabilities
Capture live traffic on a network interface and use display filters to isolate a specific TCP conversation.
Open a pcap file from a security incident and filter for suspicious DNS queries or unexpected outbound connections.
Follow a TCP stream to reconstruct the full application-layer conversation between a client and server.
Use the Statistics > I/O Graph to visualise traffic volume over time and identify the moment a problem started.
Analyse an ST 2110 RTP stream capture to verify packet timestamps, sequence numbers, and payload type.
How to learn it
Learning Resources
Wireshark official documentation at wireshark.org/docs — comprehensive and free
Chris Greer's Wireshark YouTube channel — highly regarded free tutorials from beginner to expert level
Wireshark University sample captures at wiki.wireshark.org/SampleCaptures — real pcap files covering hundreds of protocols and scenarios
TryHackMe "Wireshark: The Basics" room — free interactive lab at tryhackme.com
Pro Tip
Use capture filters (set before capture starts) not just display filters — capturing all traffic on a busy interface generates gigabytes of data in minutes, and a targeted capture filter (host x.x.x.x or port 443) captures only what you need and keeps the file manageable.
Skills that use this tool
Roles that use this tool