Wireshark is an open-source, cross-platform network packet analyser tool freely available. It is the most widely-used tool of its kind, with usage in both commercial and educational domains.

The Wireshark project, which started under the name Ethereal, was created in the late 1997s by Gerald Combs who needed a tool for tracking down network problems and wanted to learn more about networking ¹. Several people saw the potential of Ethereal and started contributing protocol dissectors and patches. In 2006, the project was renamed to Wireshark, since Combs owned the rights to the code of Ethereal, but not the trademark. Wireshark finally arrived at version 1.0 in 2008. Combs continues to maintain the overall code of Wireshark and issue releases of new versions of the software. The product website lists almost 2000 additional contributing authors. ²

Wireshark is mostly known for spoofing networks, but in a professional context, it can be used as a debugging tool to troubleshoot a company’s internal network or to see if there are any people (devices/machines/etc.) in the network who shouldn’t be a part of it.

As the Covid-19 pandemic progressed, cyber attacks became more and more popular, especially targeting large businesses rather than small startups and individuals ³. That is not to say that the latter group was safe by any means, as ransomware and phishing attacks also caused some damage ⁴. Furthermore, DDOS attacks, man in the middle attacks, ARP spoofing, and port scanning can also be identified by analyzing network traffic. With the use of a tool such as Wireshark, such attacks can be spotted by monitoring the network, provided that you know what to look for. In addition, with Wireshark, network administrators and engineers can also evaluate a network’s performance and traffic management.

Features Source and Functionality ²: Wireshark is a data capturing program that “understands” the structure (encapsulation) of different networking protocols. It can parse and display the fields, along with their meanings as specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture packets on the types of networks that pcap supports.

Wireshark is very similar to tcpdump, but has a graphical front-end and integrated sorting and filtering options. Wireshark lets the user put network interface controllers into promiscuous mode (if supported by the network interface controller), so they can see all the traffic visible on that interface including unicast traffic not sent to that network interface controller’s MAC address.

Data can be captured “from the wire” from a live network connection or read from a file of already-captured packets. Live data can be read from different types of networks, including Ethernet, IEEE 802.11, PPP, and loopback. Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, TShark. Captured files can be programmatically edited or converted via command-line switches to the “editcap” program. Data display can be refined using a display filter. Plug-ins can be created for dissecting new protocols. VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played. Raw USB traffic can be captured. Wireless connections can also be filtered as long as they traverse the monitored Ethernet. Various settings, timers, and filters can be set to provide the facility of filtering the output of the captured traffic.

References