Wireshark is a free and open-source
packet analyzer. It is used for
network troubleshooting, analysis, software and
communications protocol development, and education. Originally named
Ethereal, in May 2006 the project was renamed
Wireshark due to trademark issues.
Wireshark is
cross-platform, using the
GTK+ widget toolkit in current releases, and
Qt in the development version, to implement its user interface, and using
pcap to capture packets; it runs on
GNU/Linux,
OS X,
BSD,
Solaris, and some other
Unix-like operating systems, and on
Microsoft Windows. There is also a terminal-based (non-GUI) version called TShark. Wireshark, and the other programs distributed with it such as TShark, are
free software, released under the terms of the
GNU General Public License.
Functionality
Wireshark allows the user to put
network interface controllers that support
promiscuous mode into that mode, in order to see all traffic visible on that interface, not just traffic addressed to one of the interface's configured addresses and broadcast/multicast traffic. However, when capturing with a packet analyzer in promiscuous mode on a port on a
network switch, not all of the traffic travelling through the switch will necessarily be sent to the port on which the capture is being done, so capturing in promiscuous mode will not necessarily be sufficient to see all traffic on the network.
Port mirroring or various
network taps extend capture to any point on the network. Simple passive taps are extremely resistant to tampering.
Features
Wireshark is software that "understands" the structure (
encapsulation) of different networking protocols. It can parse and display the fields, along with their meanings as specified by different networking protocols. Wireshark uses
pcap to capture packets, so it can only capture packets on the types of networks that pcap supports.
- Data can be captured "from the wire" from a live network connection or read from a file of already-captured packets.
- Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
- Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, TShark.
- Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
- Data display can be refined using a display filter.
- Plug-ins can be created for dissecting new protocols.
- VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played.
- Raw USB traffic can be captured.
#Wireshark #Windows #Linux #Backtrack #Ubuntu #Kali-Linux
