Wireshark — Network Analysis and Diagnostics

A GUI packet analysis tool that captures network traffic and analyzes it by protocol.

Basic Information

What is this program?

Wireshark is a program that copies packets passing through the network card as they are, saves them to a file, and interprets and displays the saved packets by protocol. It can decode thousands of protocols, so you can expand and view traffic layer by layer, from Ethernet headers to HTTP headers, DNS queries, and TLS handshakes.

It is the last tool server administrators turn to when checking why communication is failing. Problems that leave no trace in application logs, such as retransmissions, out-of-order packets, TCP resets (RST), and delayed DNS responses, appear exactly as they are at the packet level.

What problems does it solve?

• Identify communication failures whose cause cannot be determined from application logs alone.
• Determine where the connection is being dropped among the server, firewall, and load balancer segments.
• Check DNS lookup failures, TCP retransmissions, and slow response times (round-trip delay) numerically.
• Verify exactly what requests and responses an API under development sends and receives.
• Use it to attach packet evidence when reporting an issue to network staff.

Key features

Live capture and saving

Receives traffic from a selected interface in real time, displays it on screen, and saves it as a .pcapng file.

• Use case: Used to reproduce a problem at a specific time, save it as a file, and analyze it again later.
• Result: Even intermittent failures that are hard to reproduce can be captured as evidence and analyzed repeatedly.
• Limitations: On servers, capture privileges (root or cap_net_raw) are required.

Display filters

Displays only captured packets that match the condition (e.g., ip.addr == 10.0.0.5 && tcp.port == 443).

• Use case: Used when you want to see only conversations for a specific host or port among tens of thousands of packets.
• Result: The analysis target shrinks to dozens of lines, so you can quickly find the problem point.
• Limitations: If the filter syntax is incorrect, the result may appear empty, so you need to check the syntax.

Protocol decoding and reassembly

Reassembles TCP streams and shows the entire HTTP request and response body.

• Use case: Used to visually check API request bodies or response JSON.
• Result: You can check request headers, cookies, and status codes that do not appear in logs.
• Limitations: For TLS-encrypted traffic, the body cannot be viewed without the keys.

Statistics tools

Provides conversations, endpoints, and protocol hierarchy statistics in tables.

• Use case: Used to see which host uses the most bandwidth or which protocol appears most often.
• Result: You can see traffic composition and top conversations at a glance.
• Limitations: Because these are summary statistics, the detailed cause of individual packets must be checked separately.

Installation and execution

Ubuntu / Debian (repository package)

Installs the version included in the distribution repository. Use the official PPA or AppImage if you need the latest features.

sudo apt update
sudo apt install wireshark
sudo dpkg-reconfigure wireshark-common   # allow regular users to capture

Windows

Download and install the official installer. The capture driver Npcap must also be installed.

1) Download the Windows x64 installer from https://www.wireshark.org/download.html
2) During installation, check the Npcap installation option
3) After installation, launch Wireshark and select an interface

macOS / source build

Use the official distribution package or Homebrew. Building from source requires CMake and development libraries.

brew install --cask wireshark
# or refer to the build procedure in the official source documentation

Real-world usage examples

Open a capture file and view only a specific host conversation

Open a previously saved pcapng file and enter a condition in the filter box.

Filter: ip.addr == 10.0.0.5 && tcp.port == 443
(Enter after typing)
Check top conversations in Statistics > Conversations

Check only specific conditions from the command line without saving

On servers where the GUI cannot be launched, use the CLI tool tshark to perform the same capture.

sudo tshark -i eth0 -f 'tcp port 443' -c 20
# -f: kernel filter, -c: capture only 20 packets

Advantages and limitations

Advantages

• Its broad protocol decoding coverage lets you read most traffic as-is.
• GUI display filters let you pick out only the needed conversations from tens of thousands of packets.
• It is free and GPL-licensed, so it can be used without restrictions even in commercial environments.
• Command-line tools such as tshark and dumpcap are included, so it can also be used on servers.

Points to consider before use

• Capture privileges are required, so administrator approval and caution are needed on production servers.
• It uses a lot of memory, so opening very large capture files at once can be burdensome.
• It takes time to become familiar with protocol structures and filter syntax.
• TLS-encrypted traffic cannot be viewed in cleartext without the session keys.

Comparison with similar programs

Official resources and further learning

• Official website — https://www.wireshark.org/
• Official documentation / knowledge base — https://www.wireshark.org/docs/wsug_html_chunked/
• Official download — https://www.wireshark.org/download.html
• Release notes — https://www.wireshark.org/docs/relnotes/
• Source / development resources — https://gitlab.com/wireshark/wireshark/
• GitHub repository — https://gitlab.com/wireshark/wireshark

Version and supported environment information was checked on the official site as of 2026-10-18. Install commands may vary depending on the distribution and version, so please also check the official installation documentation.

Actual execution screen

The screen below is a synthetic example created to illustrate checking the version on a production server (it is not an actual execution result). The screen is a synthetic example and not an actual execution result.

!Example of checking the Wireshark version and capture interface

Production server in actual operation

Source (HTML): https://games.aidebatehub.com/programs/apps/network/wireshark.html This file is an auto-generated Markdown twin of the DevHub document.