Quick take
Already sold on Wireshark?
In this articleShow
Short answer: Wireshark is the most widely used network protocol analyzer: free, open source and actively maintained (the 4.6 series is current in 2026). It records network traffic on your own computer or network and decodes thousands of protocols into readable detail. Network engineers use it to troubleshoot slow or failing connections, and security teams use it to examine suspicious traffic. It's powerful but technical — plan time to learn it.
Wireshark at a glance
Detail | Wireshark |
|---|---|
Price | Free, open source |
Platforms | Windows, macOS, Linux |
Current stable | 4.6.x |
Companion tools | TShark (command line), editcap, mergecap |
Capture format | pcapng / pcap |
Everyday troubleshooting uses
- "Why is this website slow?" — see whether delays come from DNS, connection setup or the server.
- Wi-Fi and network problems — spot retransmissions and dropped connections.
- Application issues — confirm whether an app is reaching the server it should.
- Learning — watching your own traffic is the best way to understand DNS, TCP and TLS.
Helpful display filters
Filter | Shows |
|---|---|
`dns` | Name lookups your device makes |
`ip.addr == 192.168.1.20` | Traffic for one device on your network |
`tcp.analysis.retransmission` | Signs of packet loss |
`tls.handshake` | Encrypted connection setup |
`!(arp or dns or icmp)` | Hides common background traffic |
Wireshark's "Follow Stream" view reconstructs a whole conversation between two devices for easier reading.
Defensive security uses
- Spotting unexpected connections from a device you suspect is compromised — for example unusual DNS lookups.
- Confirming encryption — checking that an app or VPN actually encrypts traffic.
- Reviewing captures from firewalls or network sensors during an incident.
- Finding legacy, unencrypted protocols on your network that should be replaced.
Responsible use
Capture traffic only on your own devices and networks, or with permission. Recording other people's communications without consent can be illegal.
Limitations
- Encrypted traffic shows connection details but not contents, which is how it should be.
- Not continuous monitoring — for always-on detection, use an IDS such as Suricata or a SIEM like Wazuh.
- Learning curve for protocol details.
Verdict
Wireshark is an essential free tool for anyone who works with networks or wants to understand them. Start by watching your own traffic, learn a handful of filters, and it quickly becomes indispensable for troubleshooting.
Frequently asked questions
Is Wireshark free?
Yes. It's free and open source.
Is Wireshark safe to install?
Yes, when downloaded from wireshark.org. On Windows it installs Npcap to capture traffic.
What's the difference between Wireshark and Nmap?
Wireshark passively records and decodes traffic; Nmap actively checks which devices and services are on a network.
Sources
- Wireshark, Official site and downloads
- Wireshark, User's guide
- Wireshark, Display filter reference
The bottom line
