Skip to content
SPECIFICTION
Get listed

Wireshark

wireshark.org

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit wireshark.org
Spec score 8.2 #6 of 22 in Network Packet Capture Software

What it is

Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.

Spec sheet

What it does
Wireshark captures and interactively examines traffic moving across computer networks for troubleshooting, analysis, development and education.Read 15 Oct 2026 · wireshark.org
Purpose
Wireshark captures and interactively browses network traffic as a network protocol analyzer.Read 29 Sep 2026 · wireshark.org
API
The sharkd daemon exposes JSON-RPC over standard input or Unix/TCP sockets for programmatic packet dissection, filtering and analysis.Read 15 Oct 2026 · wireshark.org
Support
Community support is available through the Q&A site and Wireshark users mailing list.Read 29 Sep 2026 · wireshark.org
License
Wireshark is open-source software released under the GNU General Public License version 2, and the downloaded version is the full version without a license fee.Read 29 Sep 2026 · wireshark.org
Founded
1998Read 23 Sep 2026 · wireshark.org
Analysis features
Features include VoIP analysis, packet coloring rules, and export to XML, PostScript, CSV, or plain text.Read 29 Sep 2026 · wireshark.org
API methods
Sharkd documents methods for loading captures, listing frames and fields, compiling filters, following streams, retrieving statistics and setting preferences.Read 15 Oct 2026 · wireshark.org
Capture and analysis
It supports live capture and offline analysis, with a graphical interface and the TShark terminal utility.Read 29 Sep 2026 · wireshark.org
Capture dependency
The Windows packages include Npcap, which is required for live packet capture.Read 29 Sep 2026 · wireshark.org
Capture limitation
The traffic visible to Wireshark depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports.Read 29 Sep 2026 · wireshark.org
Capture-file export
It saves captures and exports all or selected packets in multiple capture formats.Read 15 Oct 2026 · wireshark.org
Capture-file import
It opens packet files produced by tcpdump, WinDump, Wireshark and other capture programs, and can import hexadecimal dumps.Read 15 Oct 2026 · wireshark.org
Company facts
LinkedIn describes the Wireshark Foundation as a San Francisco nonprofit in computer and network security with a stated company size of 2–10 employees.Read 15 Oct 2026 · linkedin.com
Decryption
Documented supported decryption covers protocols including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP and WPA/WPA2.Read 15 Oct 2026 · g2.com
Documentation
Official material includes a User’s Guide, Developer’s Guide, wiki, FAQ, Q&A site, issue tracker and user/developer mailing lists.Read 15 Oct 2026 · wireshark.org
Extensibility
The extcap interface lets external binaries or scripts appear as capture interfaces and be configured through the GUI.Read 15 Oct 2026 · wireshark.org
File formats
It reads and writes many capture formats, including pcap and pcapng, and can decompress gzip-compressed capture files on the fly.Read 29 Sep 2026 · wireshark.org
Filtering
Users can filter packets using many criteria, including display filters for addresses, ports and protocols.Read 15 Oct 2026 · wireshark.org
Foundation
Since 2023 the project has been operated by the Wireshark Foundation, a U.S. 501(c)(3) nonprofit that provides infrastructure, hosts SharkFest and promotes network education.Read 15 Oct 2026 · wireshark.org
History
Gerald Combs began Ethereal in late 1997; its first public release was July 1998, and the project adopted the Wireshark name in 2006.Read 15 Oct 2026 · wireshark.org
Licence
Wireshark is open source under GNU GPL version 2 or later, with source code available for modification and redistribution under the licence.Read 15 Oct 2026 · wireshark.org
Limit: Capterra users
Capterra complaints repeatedly mention an outdated or unfriendly interface, beginner complexity, slow performance on captures and difficult filter syntax.Read 15 Oct 2026 · capterra.com
Limit: G2 users
Repeated complaints include a steep learning curve, cluttered or dated interface, complex filters, large-memory capture slowdowns and lack of automatic maliciousness explanations.Read 15 Oct 2026 · g2.com
Limit: independent reviews
TechRadar says effective use requires networking knowledge, the tool is not an IDS, it provides no alerts and support is mainly self-service community documentation.Read 15 Oct 2026 · techradar.com
Linux and BSD packaging
Binary packages are listed for distributions including Ubuntu, Debian, Fedora, Arch, FreeBSD, NetBSD, OpenBSD and Oracle Solaris.Read 15 Oct 2026 · wireshark.org
Live capture
It captures live packet data from network interfaces.Read 15 Oct 2026 · wireshark.org
macOS requirements
Current documentation supports macOS 11 and later, with older release branches covering earlier macOS versions.Read 15 Oct 2026 · wireshark.org
Mobile availability
The official Wireshark wiki states that no Android port and no iOS port currently exist; Apple App Store restrictions and capture-privilege requirements are cited as barriers.Read 15 Oct 2026 · wiki.wireshark.org
Not an IDS
Wireshark does not act as an intrusion-detection system and does not automatically warn that traffic is malicious.Read 15 Oct 2026 · wireshark.org
Notable news
On October 6, 2026 the Foundation announced an expanded board and a mission emphasizing sustainable, community-driven open-source governance.Read 15 Oct 2026 · wireshark.org
Output formats
It can export analysis to XML, PostScript, CSV and plain text, according to TechRadar.Read 15 Oct 2026 · techradar.com
Plugin model
External capture programs can be placed in Wireshark extcap directories, while separate plugin directories are supported for extensions.Read 15 Oct 2026 · wireshark.org
Praise: Capterra users
Capterra reviewers commonly cite real-time capture, detailed packet visibility, troubleshooting usefulness, filtering and avoiding paid licence costs.Read 15 Oct 2026 · capterra.com
Praise: G2 users
Reviewers repeatedly praise packet capture, filtering, real-time monitoring, protocol analysis, troubleshooting value and the free open-source model.Read 15 Oct 2026 · g2.com
Praise: TrustRadius users
TrustRadius summarizes repeated praise for affordability, packet capture and analysis, and real-time network visibility.Read 15 Oct 2026 · trustradius.com
Project history
The project began in 1998 and is developed with contributions from networking experts around the world.Read 29 Sep 2026 · wireshark.org
Protocol detail
The analyzer displays highly detailed protocol information and includes many protocol dissectors.Read 15 Oct 2026 · wireshark.org
Protocol inspection
It supports deep inspection of hundreds of protocols.Read 29 Sep 2026 · wireshark.org
Rating on Capterra
4.6 out of 5 from 51 reviews.Read 15 Oct 2026 · capterra.com
Rating on G2
4.7 out of 5 from 148 reviews.Read 15 Oct 2026 · g2.com
Rating on Trustpilot
4.0 out of 5 from 3 reviews.Read 15 Oct 2026 · trustpilot.com
Rating on TrustRadius
8.9 out of 10 from 154 reviews and ratings.Read 15 Oct 2026 · trustradius.com
Security release practice
The August 12, 2026 releases 4.6.8 and 4.4.18 fixed multiple vulnerabilities, with release notes linked from the project news page.Read 15 Oct 2026 · wireshark.org
Security updates
The download page links release security advisories, including notices for dissector crashes and other vulnerabilities.Read 29 Sep 2026 · wireshark.org
Self-hosting
The software is distributed as source and native packages, so organizations can build and operate it locally without a hosted service.Read 15 Oct 2026 · wireshark.org
Supported operating systems
Official learning material lists Windows, macOS, Linux and UNIX support, with source builds possible on other platforms.Read 15 Oct 2026 · wireshark.org
Users
Network professionals, security experts, developers, and educators use Wireshark.Read 29 Sep 2026 · wireshark.org
VoIP analysis
The product includes tools for analyzing Voice over IP communications.Read 15 Oct 2026 · g2.com
Windows requirements
The documented Windows baseline includes a modern 64-bit Intel or Arm processor, 500 MB RAM, 500 MB disk space, a modern display and a supported capture network card.Read 15 Oct 2026 · wireshark.org

Plans and prices

Wireshark Free Full version · no license fee Read 29 Sep 2026 · wireshark.org
Wireshark Free no license keys or fees · use on any number of computers · GPL source available Read 15 Oct 2026 · wireshark.org

Every Wireshark plan and price →

Strong points and limits

Strong points

  • Free full version under GNU GPL version 2.
  • Supports live capture and offline analysis.
  • Reads and writes pcap and pcapng formats.
  • Includes decryption for several listed protocols.
  • Available on Linux, macOS, and Windows.

Limits

  • Windows live capture requires Npcap.
  • Visible traffic depends on the interface and network setup.
  • Switched networks may hide unicast traffic between other ports.
  • Community support is through a Q&A site and mailing list.

Who it suits

Wireshark suits network professionals, security experts, developers, and educators who need to inspect captured traffic. It offers both a graphical interface and a terminal utility.

Verdict

Wireshark combines live capture, offline analysis, broad protocol inspection, and command-line access without a license fee. Capture visibility depends on the local network and capture setup, so it may not show all traffic on a switched network.

Where Specifiction places it

Alternatives to WiresharkAll alternatives →