wireshark/wireshark
Wireshark
Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It functions as a packet capture tool that intercepts live data from network interfaces and a TCP/IP dissector that decodes network protocol layers to translate raw binary packets into human-readable fields.
The system provides capabilities for protocol stream reconstruction, grouping related packets into cohesive conversations between endpoints. It also operates as a packet file converter, allowing for the reading, modification, and conversion of network capture files across various storage formats and compression standards.
The project covers a broad surface of traffic analysis, including network address resolution, packet filtering, and binary pattern searching. It supports specialized protocol decoding, such as SNMP packet decoding using MIB files and DECT traffic analysis, alongside utilities for synthetic packet trace generation.
Analysis can be performed through both a graphical interface and a text-mode command line interface for environments without a graphical user interface.
Features
- Network Traffic Analyzers - Wireshark analyzes data packets transmitted over a computer network to diagnose connectivity issues and monitor protocol behavior.
- Packet Capture Utilities - A system for intercepting live data from network interfaces and saving it to files for historical analysis.
- Network Traffic Analysis - Intercepting and inspecting data packets from a network interface to diagnose connectivity issues and monitor protocol behavior.
- Networking and Protocols - Wireshark decodes network protocol layers to translate raw binary packets into human-readable fields and summaries.
- Packet Capture Tools - Provides capabilities to read network traffic data from various file formats and compressed archives for historical analysis.
- Dissection Engines - Implements a modular engine that recursively parses binary streams into structured objects based on protocol specifications.
- Protocol Debugging - Decoding raw binary network packets into human-readable fields to verify how specific protocols are communicating.
- Protocol Dissectors - A utility that decodes network protocol layers and reconstructs data streams into cohesive conversations between endpoints.
- Network Traffic Inspectors - An application for filtering and searching through packet data to diagnose connectivity issues and monitor protocol behavior.
- Packet File Converters - A tool for reading, modifying and converting network capture files between various storage formats and compression standards.
- Stream Reassemblers - Groups individual packets into continuous bidirectional conversations by combining fragmented data into complete messages.
- TCP Stream Reassembly - Wireshark groups related packets into a cohesive conversation to view the complete exchange of data between two endpoints.
- Traffic Flow Parsing - Extracts structured request and response data from binary network capture archives, including compressed formats.
- Display Filters - Provides high-level logical filters to isolate specific packets within a capture for visualization and analysis.
- Packet Decapsulation - Processes network traffic by recursively stripping headers from the outermost link layer down to the innermost application layer.
- Network Forensics - Analyzes historical capture files and reconstructed protocol streams to identify security breaches or system failures.
- Real-time Monitoring - Wireshark dissects captured data immediately as it is written to disk to monitor traffic as it happens.
- Command Line Interfaces - Provides a text-mode command line interface for capturing and inspecting network data in environments without a GUI.
- Network Address Resolution - Wireshark maps numerical IP and MAC addresses to human-readable hostnames and manufacturer names using local and remote lookups.
- Address Labeling - Wireshark matches captured network traffic against a database of known hardware and protocol addresses to label frames.
- Network Troubleshooting Tools - Mapping numerical IP and MAC addresses to hostnames and manufacturers to resolve connectivity problems in a network.
- Ring-Buffer Capture - Writes intercepted network data to a circular memory or disk buffer to prevent packet loss during high-volume traffic.
- Packet Capture Storage - Writes captured network data to temporary files, single files, or ring buffers to prevent data loss.
- Packet Search Utilities - Wireshark locates specific packets within a capture file using protocol trees, regular expressions, binary patterns, or display filters.
- SNMP MIB Mapping - Resolves numerical SNMP identifiers into human-readable names by loading and querying external Management Information Base files.
- Heuristic Protocol Identification - Determines the protocol of unknown packets by analyzing payload patterns and matching them against known signatures.
- Network Analysis - Listed in the “Network Analysis” section of the Awesome Mac awesome list.
- Network Analysis Tools - Industry-standard network protocol analyzer for deep packet inspection.
- Networking Tools - Comprehensive network protocol analyzer and packet sniffer.
