Wireshark is a widely used network protocol analyzer designed for troubleshooting, protocol development, education, and detailed inspection of network traffic. It captures packets from a live network interface or reads them from a saved capture file, then decodes the raw bytes into structured protocol layers that a human can read. Under the hood, Wireshark relies on platform-specific capture libraries: on Linux and Unix systems it uses libpcap, while on Windows it uses Npcap (the modern successor to the older WinPcap). Because these libraries sit between the network card and the application, they enable features like promiscuous mode, which instructs the network interface to capture every frame on the segment, not just those addressed to the capture host.
One of the most important conceptual distinctions in Wireshark is the difference between capture filters and display filters. Capture filters use Berkeley Packet Filter (BPF) syntax and are applied before packets are written to disk, so they limit what is recorded at all; this is useful for keeping capture files small on busy links. Display filters, by contrast, use Wireshark's own rich expression language and are applied after capture to narrow what is visible on screen without dropping any data. A simple address filter such as host 192.168.1.1 written in BPF is written as ip.addr == 192.168.1.1 in Wireshark's display syntax, illustrating the different conventions.
Display filter expressions can be combined using logical operators. Wireshark accepts either symbolic forms (&&, ||, !) or word forms (and, or, not), and parentheses can be used to group conditions for complex queries like (ip.addr == 192.168.1.1 && tcp.port == 80) || (ip.addr == 192.168.1.2 && tcp.port == 443). Comparisons can target addresses, ports, lengths, flags, and many other fields; for example, tcp.port == 80 narrows the view to a specific service, while frame.len > 1000 highlights larger-than-average frames. Searches inside payload data are supported with frame contains "search_string", which is especially handy when hunting for a known token in unencrypted traffic.