Skip to content
THREATWIRE

Wireshark

Network protocol analyser

The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.

Open sourceGPL-2.0-only
Visit website View repository Docs
Homepage of Wireshark
Official website (wireshark.org), captured by ThreatWire.

What Wireshark does

Wireshark captures network traffic and decodes it with dissectors for thousands of protocols. Display filters, follow-stream views, statistics and expert information help analysts troubleshoot networks, analyse attacks and understand protocols.

The command-line companion TShark offers the same dissection for scripting. Development happens on GitLab; the GitHub repository is a read-only mirror. The project is run by the Wireshark Foundation.

Key features

  • Dissectors for thousands of protocols
  • Live capture and many capture file formats
  • Powerful display filters and stream following
  • TShark command-line analyser
  • Decryption support for several protocols with keys

Licence

GPL-2.0-only · GNU GPL v2 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: GPL-2.0.

Security of Wireshark itself

No published advisory found for Wireshark in GitHub repository advisories. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

Network scanning and analysisIDS, IPS and network monitoringDigital forensics and incident response#packet-analysis#pcap#desktop#protocols#wireshark#packet-capture#tshark#stratoshark

Related tools

  • masscan

    Asynchronous TCP port scanner for large ranges

    Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.

    Stars
    26k
    Forks
    3.2k
    Last commit
    14 days ago
    AGPL-3.0-onlyOpen sourceNetwork scanning and analysis

  • RustScan

    Fast port scanner that hands results to Nmap

    Port scanner written in Rust that finds open ports quickly and then pipes them into Nmap for service detection, with a scripting engine of its own.

    Stars
    21k
    Forks
    1.4k
    Last commit
    14 days ago
    GPL-3.0-onlyOpen sourceNetwork scanning and analysis

  • Nmap

    Network discovery and security auditing tool

    The Network Mapper: host discovery, port scanning, service and OS detection, and the Nmap Scripting Engine (NSE) for further checks.

    Stars
    14k
    Forks
    2.9k
    Last commit
    today
    NPSL-0.95Source-availableNetwork scanning and analysis

  • Zeek

    Network security monitoring and traffic analysis framework

    Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.

    Stars
    8.1k
    Forks
    1.4k
    Last commit
    today
    BSD-3-ClauseOpen sourceIDS, IPS and network monitoring
    Alternative toDarktrace

  • mitmproxy

    Interactive TLS-capable intercepting HTTP proxy

    Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.

    Stars
    46k
    Forks
    4.8k
    Last commit
    today
    MITOpen sourceWeb application testing
    Alternative toBurp Suite Professional
Share on X@threatwire_https://www.threatwire.tech/tools/wireshark