That makes it easier to understand what happened on the network instead of guessing. Learn how to choose an interface, start a live capture, and inspect the traffic that appears in real time. Build practical packet analysis and troubleshooting knowledge that supports networking and infrastructure career growth. It can also support people exploring network engineering careers and building stronger troubleshooting skills. This site is built for people who want to understand packet captures, protocol behavior, and real network traffic in a clearer, more practical way.
For example, an alternative is to run tcpdump or the dumpcap utility that comes with Wireshark with superuser privileges to capture packets into a file, and later analyze the packets by running Wireshark with restricted privileges. Wireshark is a data capturing program that “understands” the structure (encapsulation) of different networking protocols. Wireshark is cross-platform, using the Qt widget toolkit in current releases to implement its user interface, and using pcap to capture packets; it runs on Linux, macOS, BSD, Solaris, some other Unix-like operating systems, and Microsoft Windows. You can narrow the view using display filters, making it easier to inspect specific conversations or protocols. Any single frame selected in the top pane is further explained in the tool’s middle panel.

• Explore skills, tools, and career paths for people building practical networking and infrastructure knowledge.
• Each Windows package comes with the latest stable release of Npcap, which is required for live packet capture.
• All present and past releases can be found in our download area .
• Wireshark is an open-source network protocol analysis software program, widely considered the industry standard.
• It has a rich and powerful feature set and is world’s most popular tool of its kind.
• Wireshark is a data capturing program that “understands” the structure (encapsulation) of different networking protocols.

Can I use Wireshark as part of my commercial product?

• Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline.
• This might be because the interface on which you’re capturing is plugged into an Ethernet or Token Ring switch; on a switched network, unicast traffic between two ports will not necessarily appear on other ports – only broadcast and multicast traffic will be sent to all ports.
• Wireshark is probably already installed because it’s part of the basic package.
• Finally, Wireshark’s bottom pane displays the raw frame, with a hexadecimal rendition on the left and the corresponding American Standard Code for Information Interchange values on the right.
• If you can capture on the interface with tcpdump, send mail to email protected giving full details of the problem, including
• Each major release branch of Wireshark supports the versions of Windows that are within their product lifecycle at the time of the “.0” release for that branch.

Install Wireshark safely and get set up for packet capture and network troubleshooting. Learn how packets move across networks, how protocols like DNS, TCP, HTTP, and TLS operate, and how packet captures are used to diagnose real-world network problems. Streamline your data collection and vendor risk assessments with UpGuard’s SIG Lite risk-mapped questionnaire.

Wireshark capture filters

RTP doesn’t have a standard port number, so 1) doesn’t work; it doesn’t, as far as I know, have any “signature”, so 2) doesn’t work. Whether you will be able to capture in monitor mode depends on the operating system, adapter, and driver you’re using. Even on those that do, monitor mode might not be supported by the operating system or by the drivers for all interfaces. On some platforms, or with some cards, this might require that you capture in monitor mode – promiscuous mode might not be sufficient. This would probably require that you capture in promiscuous mode or in the mode called “monitor mode” or “RFMON mode”. If your distribution has a bug such as this, you may have to run a standard kernel from kernel.org in order to get high-resolution time stamps.

Features

This is really the same question as a previous one; see the response to that question. If not, then see the main Npcap page – check the “Patches, Bug Reports, Questions, Suggestions, etc” section. If you disable network address-to-name translation – for example, by turning off the “Enable network name resolution” option in the “Capture Options” dialog box for starting a network capture – the lookups of the address won’t be done, which may speed up the process of reading the capture file after the capture is stopped. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you’re using are necessary, if any, to support capturing the FCS of a frame. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you’re using are necessary, if any, to support capturing those packets.

Display Filter Examples

At least on x86-based machines, Linux can get high-resolution time stamps on newer processors with the Time Stamp Counter (TSC) register; for example, Intel x86 processors, starting with the Pentium Pro, and including all x86 processors since then, have had a TSC, and other vendors probably added the TSC at some point to their families of x86 processors. This is really the same question as the previous one; see the response to that question. In your mail, please give full details of the problem, as described above, and also indicate that the problem occurs with tcpdump not just with Wireshark. If you can capture on the interface with tcpdump, send mail to email protected giving full details of the problem, including If you are having trouble capturing on a particular network interface, and you’ve made sure that (on platforms that require it) you’ve arranged that packet capture support is present, as per the above, first try capturing on that device with tcpdump. You may need to run Wireshark from an account with sufficient privileges to capture packets, such as the super-user account, or may need to give your account sufficient privileges to capture packets.

The top panel lists frames individually, with key data on a single line. This means that you should disable name resolution when capturing in monitor mode; otherwise, when Wireshark (or TShark, or tcpdump) tries to display IP addresses as host names, it will probably block for a long time trying to resolve the name because it will not be able to communicate with any DNS or NIS servers. Wireshark gets time stamps from libpcap/Npcap, and libpcap/Npcap get them from the OS kernel, so Wireshark – and any other program using libpcap, such as tcpdump – is at the mercy of the time stamping code in the OS for time stamps. You can make that setting the default by selecting “Preferences” from the “Edit” menu, turning off the “Enable network name resolution” option in the “Name resolution” options in the preferences dialog box, and using the “Save” button in that dialog box; note that this will save all your current preference settings. For any particular link-layer network type, unless the OS supplies the FCS of a frame as part of the frame, or can be configured to do so, Wireshark – and other programs that capture raw packets, such as tcpdump – cannot capture the FCS of a frame. Unless the OS always supplies packets with errors such as invalid CRCs to the raw packet capture mechanism, or can be configured to do so, invalid CRCs to the raw packet capture mechanism, Wireshark – and other programs that capture raw packets, such as tcpdump – cannot capture those packets.

Basic information

Users can apply filters to view specific streams of data or analyze how different devices communicate. The third panel in the Wireshark UI shows the raw data of a packet in hexadecimal and ASCII format for further analysis. The tool breaks down the packet into layers in OSI or TCP/IP layers and can be expanded into fields showing ports, flags, TTL values, and more. Wireshark UI consists of three different panes that display data from captured packets.
Wireshark can open packet captures from a large number of capture programs. The specific media types supported may be limited by several factors, including your hardware and operating system. However, to really appreciate its power you have to start using it. You can stay informed about new Wireshark releases by subscribing to the wireshark-announce mailing list . Past releases can be found by browsing the all-versions directories under each platform directory. You can download source code packages and Windows installers which are automatically created each time code is checked into the source code repository .
A network protocol analyzer, also referred to as a packet sniffer informally, is used to capture and analyze packets on a network to troubleshoot network behavior for bottlenecks, anomalous performance, and security threats. Wireshark is a leading open source network protocol analyzer that security analysts, network admins, and developers can use to capture and analyze network traffic to improve performance or detect security vulnerabilities. Is your security program benefiting from the full potential of open source innovation? It was released in 2025 and donated to the Wireshark Foundation to build on Wireshark’s legacy. Stratoshark is an open source companion tool for Wireshark that shares the same UI, dissection engine, and filtering code, making it easier for Wireshark users to pick up and learn it quickly. Before running a session, users can also select a capture filter, such as traffic to a single host, port 80 traffic, or TCP.