Wireshark is a free, open source network protocol analyzer for Windows, macOS and Linux. It captures packets from network interfaces or opens previously recorded traffic, then decodes the data into protocol fields that can be examined individually. Network administrators, developers and students can use it to investigate connection problems, check how an application communicates and study the messages exchanged between devices.
Packet capture
A capture starts with the interfaces available on the computer. Wireshark shows activity beside each interface so the user can identify where traffic is flowing, select the required connections and begin collecting packets. Capture options control how many bytes of each packet are retained, where the recording is saved and when collection stops. Supported capture media include Ethernet, wireless networks, Bluetooth and USB, with availability depending on the operating system and hardware.
For longer recordings, Wireshark can create successive files when a size or time condition is reached. A ring buffer limits the recording to a chosen number of files, replacing older files as capture continues. Wireless monitor mode, which captures raw wireless headers, depends on the adapter, driver and operating system.
How Wireshark decodes packets
The packet list presents a summary of each captured message. Selecting a row opens its decoded protocol structure in the details pane and its underlying data in the bytes pane. Expanding a protocol exposes its fields; selecting one highlights the corresponding bytes. This connects an interpreted value, such as a protocol flag or address, to the data that carried it.
Wireshark’s protocol dissectors interpret the different layers within a packet. A single packet can therefore contain several sets of details, from its link-layer header through transport and application information. The same inspection tools work on saved captures, including recordings made with tcpdump and other supported capture programs, so analysis does not require collecting traffic on the computer being used to read it.
Capture filters and display filters
Wireshark separates the decision about what to record from the decision about what to display. A capture filter restricts collection using expressions for hosts, ports, protocols and traffic direction. Packets excluded at this stage are absent from the recording.
Display filters work on packets already collected. They can select a protocol, the presence of a field or particular field values, hiding unrelated packets while preserving the complete capture. Clearing the expression restores the hidden rows.
Protocol streams
Following a stream brings together data from an exchange that would otherwise be spread across many packet rows. The user selects a packet and chooses a supported stream type; Wireshark applies a matching display filter and opens the conversation. Client and server traffic are distinguished, and the view can show both directions or only one.
Text, hexadecimal and raw representations serve different kinds of payload. Text can be searched within the stream, while saving the raw data produces a binary file for further examination. Wireshark supports stream views for protocols including TCP, UDP, HTTP/2 and QUIC. Reading decrypted TLS content requires the appropriate session secrets or keys; capturing encrypted packets alone does not expose their application content.
Expert Information
Expert Information collects notable events that protocol analysis finds in the capture. Entries include a packet reference, an explanatory summary, the protocol involved and a severity level. Malformed messages, unusual response codes and suspicious sequence behavior can be grouped and searched instead of being located one packet at a time.
The list can follow the current display filter, keeping the investigation within the selected traffic. These entries identify places to examine rather than establish a fault automatically: a reported event needs to be interpreted in the context of the connection and capture.
Traffic statistics
Protocol Hierarchy summarizes how much of the capture belongs to each protocol using packet counts, byte counts and percentages. Because a packet can contain several protocol layers, those percentages are not a division into mutually exclusive categories.
The Conversations window groups traffic between endpoint pairs. Counts, duration and directional rates help distinguish a brief exchange from a sustained transfer, and a selected conversation can lead directly to its stream. I/O Graphs then show changes over time, using chosen intervals and filters for individual plotted series. A user can compare traffic patterns and click a point on the graph to return to an associated packet.
RTP analysis
For captured voice traffic, Wireshark provides RTP stream analysis with packet sequence information, arrival spacing, jitter and calculated packet loss. Stream graphs link timing changes to individual packets, giving a more detailed view of an audio exchange than a total traffic counter.
The RTP Player displays waveforms and plays streams that Wireshark can decode. It can also export decoded audio or a stream’s raw payload. Codec support affects playback, while payload export allows further examination when the audio format cannot be decoded within Wireshark.
Capture exports
Wireshark saves packet recordings in pcapng and other capture formats, including pcap. Selected packets can be exported into a smaller capture for a focused investigation. Format conversion can discard information that the destination format cannot hold, such as comments or timestamp precision.
Packet summaries and decoded details can also be exported as text, CSV, JSON or XML for reporting and external processing. Export Objects extracts reassembled files from supported protocol exchanges, such as documents and images transferred over HTTP.
