Wireshark is a free packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options. Wireshark allows the user to put the network interfaces that support promiscuous mode into that mode, in order to to see all traffic visible on that interface, not just traffic addressed to one of the interface’s configured addresses.
Wireshark is software that «understands» the structure of different networking protocols. Thus, it is able to display the encapsulation and the fields along with their meanings of different packets specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture the packets on the types of networks that pcap supports.
— Data can be captured «from the wire» from a live network connection or read from a file that recorded already-captured packets.
— Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
— Captured network data can be browsed via a GUI.
— Captured files can be programmatically edited or converted via command-line switches to the «editcap» program.
— Data display can be refined using a display filter.
— Plug-ins can be created for dissecting new protocols.
— VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played.
— Raw USB traffic can be captured with Wireshark.