Wireshark is a widely used network protocol analyzer that captures and inspects packets traversing a network interface. Originally developed for troubleshooting, packet analysis, software development, and education, it has become the de facto standard for deep packet inspection across industries. The tool decodes packets at every layer of the network stack, presenting them in a structured view that includes raw bytes, layered protocol fields, and human-readable summaries. Wireshark's dissection engine breaks each packet into its constituent protocols, allowing analysts to drill down from Ethernet frames through IP, transport, and application layers in a single display. Dissectors are modular components that decode specific protocols, and they can be customized through Lua scripts or C plugins to handle proprietary or unusual traffic.
A foundational distinction in Wireshark is between capture filters and display filters, each serving a different purpose in the analysis workflow. Capture filters use Berkeley Packet Filter (BPF) syntax and limit what packets are recorded to disk during the capture process; for example, the filter host 192.168.1.1 restricts capture to traffic involving that IP address. Common capture filter primitives include host and port keywords with src and dst qualifiers, alongside protocol names like tcp, udp, and icmp, and the net keyword for CIDR ranges such as net 192.168.1.0/24. In contrast, display filters operate on already-captured packets using Wireshark's own expression language, allowing analysts to slice and dice traffic after the fact without losing data. Because capture filters discard packets before they are saved, display filters are generally safer for investigations where you may not yet know what you are looking for.
Several capture options shape how Wireshark collects data. Promiscuous mode enables the network interface to capture all traffic on the local segment rather than only frames addressed to the host's MAC address, which is essential for monitoring shared media or switched networks via port mirroring. Wireshark's packet capture is delegated to platform-specific libraries: libpcap on Linux and Unix systems, and Npcap, the modern successor to WinPcap, on Windows. Captures can be saved in either pcap, the legacy format, or pcapng, the newer PCAP Next Generation format that supports richer metadata, multiple interfaces, and advanced features such as extended annotations.
Other capture controls include snapshot length, which limits the number of bytes captured per packet to reduce file size; buffer size, which determines how much data can be held in memory before being written to disk; ring buffers, which rotate through a fixed number of files to manage long-term captures; and stop conditions that halt the capture after a specified number of packets, files, or elapsed time. The capture interface is selected through Capture > Options, where promiscuous mode, output file format, and ring buffer settings can all be configured together.