Wiresharktcpdump
VSWireshark
Network protocol analyser for capturing and inspecting traffic.
Official source: wireshark.orgLast verified: awaiting review · How we check softwareDeveloper: Wireshark Foundation
What is Wireshark?
Wireshark is a widely used network protocol analyser. It captures traffic from a network interface, or opens a saved capture file, and breaks every packet down into its protocol layers so you can see exactly what was sent and received. Display filters narrow thousands of packets to the conversation you care about, and features such as Follow Stream and the Statistics menu help you reconstruct what happened. Network engineers use it to troubleshoot slow or failing connections, security teams use it to investigate suspicious traffic, and students use it to see how protocols like DNS, DHCP, TCP and HTTP actually behave. Wireshark is free and open source, and only needs to be run on networks you own or are authorised to monitor.
Key features
- Live packet capture
- Deep protocol inspection
- Powerful display filters
Who should use Wireshark?
- IT professionalBuild a setup for this
- Network EngineerBuild a setup for this
- CybersecurityBuild a setup for this
- DeveloperBuild a setup for this
- Security & privacyBuild a setup for this
- IT EngineerBuild a setup for this
Supported platforms
Pricing & licence
Open Source Free and open source
Open source: the source code is public, so anyone can inspect it, and it's free to use.
Prices change, so check wireshark.org for current pricing.
Pros & cons
Pros
- Industry standard
- Free
Cons
- Steep learning curve
Installation
Windows
Windows · Winget
PS> winget install --id WiresharkFoundation.Wireshark --exact --source wingetmacOS
Mac · Homebrew
$ brew install --cask wireshark-appLinux
Linux · Flatpak (any distribution)
$ flatpak install flathub org.wireshark.WiresharkLinux · APT (Ubuntu and Debian-based)
$ sudo apt install wiresharkPackage names were checked against each official package registry, and commands install the same software as the official download. Only run commands you understand.
Alternatives to Wireshark
- TSharkBest for capturing on servers without a desktop, or in scriptsView Alternative
- tcpdumpBest for quick captures on servers, then analysis in WiresharkView Alternative
- ZeekBest for ongoing security monitoring and investigation of past activityView Alternative
Comparisons
WiresharkRelated guides
Best software for IT professionals
Diagnostic, networking and USB tools every IT technician should carry.
8 min read
How to set up a cybersecurity home lab
Build a safe, isolated practice lab with free tools: virtual machines, an analysis machine, a deliberately vulnerable target and packet capture.
8 min read
Related software
Nmap
Networking
Network scanner that discovers hosts, ports and services.
Open Source
Available for Windows, macOS, Linux
TCPView
Networking
Shows active network connections and the programs using them.
Free
Available for Windows
ping (iputils)
Networking
Checks whether a host is reachable and measures response time.
Open Source
Available for Linux
Cisco Packet Tracer
Networking
Network simulation for learning networking.
Free
Available for Windows, macOS, Linux
Wireshark FAQ
Is Wireshark free?
Yes. Wireshark is free and open source, with no paid edition.
Is it legal to use Wireshark?
Wireshark is legal software, but capturing other people's traffic can break the law or workplace policy. Use it on your own network, in a lab, or where you have explicit permission to monitor.
Can Wireshark see inside HTTPS traffic?
It captures HTTPS packets, but their contents are encrypted. You can only decrypt TLS traffic that you are authorised to inspect, for example by giving Wireshark the session keys that a browser you control writes to a key log file.
What is the difference between Wireshark and TShark?
They are the same project. Wireshark is the graphical application; TShark is its command-line version, which uses the same protocol dissectors and display filters and is useful on servers and in scripts.
Which platforms does Wireshark support?
Wireshark is available for Windows, macOS and Linux. It isn't available for Android and iPhone & iPad.
Can I install Wireshark with Winget?
Yes. Run "winget install --id WiresharkFoundation.Wireshark --exact --source winget" in PowerShell or Windows Terminal. The package ID was checked against Microsoft's official Winget repository.
Can I install Wireshark with Homebrew?
Yes. Run "brew install --cask wireshark-app" in Terminal.
What are the alternatives to Wireshark?
Common alternatives include TShark, tcpdump and Zeek. See the full list of Wireshark alternatives for how they differ.
How does Wireshark compare with tcpdump?
We compare Wireshark with tcpdump side by side, covering platforms, price, features and which kind of user each suits.
Where can I download Wireshark safely?
From the official website, wireshark.org. Aptorise links only to official sources and never hosts installers.