Output can be exported to XML, PostScript®, CSV, or plain text Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)ĭecryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2Ĭoloring rules can be applied to the packet list for quick, intuitive analysis Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many othersĬapture files compressed with gzip can be decompressed on the fly The most powerful display filters in the industry

Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many othersĬaptured network data can be browsed via a GUI, or via the TTY-mode TShark utility Wireshark is a great tool for pentester and has a rich feature set which includes the following:ĭeep inspection of hundreds of protocols, with more being added all the time It is cross platform, meaning that it runs on Windows, Mac, Linux, and FreeBSD. This free and open source application is so widely used in the industry because it works. It is used by IT and Network administrators to troubleshoot network connectivity issues and by Network Security analysts to dissect network attacks.

Wireshark is the most widely used network capture and protocol analyzer on the market.

Tshark pcap