What Wireshark does
Wireshark is a free, open-source network protocol analyzer released under the GNU General Public License. It enables users to capture live network traffic and inspect individual packets in close detail, making it a widely used tool among network engineers, security analysts, system administrators, and protocol developers. At its core, Wireshark decodes a broad range of network protocols across all layers of the network stack — from link-layer frames up through transport protocols like TCP and UDP to application-layer protocols such as HTTP, DNS, TLS, and many more. This layered packet view helps users trace the exact path data takes through a network exchange. Capture filters let users restrict what traffic is recorded during a live session, while display filters allow precise querying of an existing capture file. Wireshark can follow a full TCP, UDP, or TLS stream to reconstruct an entire conversation as human-readable text — useful when diagnosing application behavior or inspecting unencrypted payloads. Statistics tools built into Wireshark include I/O graphs, conversation lists, protocol hierarchy summaries, and endpoint statistics, all of which help make sense of high-volume captures. Color-coding rules can be defined to visually highlight traffic types or anomalies. Wireshark reads and writes captures in the widely adopted pcap and pcapng formats, and also supports a range of other capture file formats for interoperability with other network tools. On Windows, the official installer bundles the Npcap capture driver, which is required for live packet capture. The application runs on Windows, macOS, and Linux. This page provides the full offline standalone installer sourced directly from the official Wireshark publisher. For your safety, always download Wireshark only from its official publisher at www.wireshark.org.
