Wireshark — The free, open-source protocol analyzer that dissects hundreds of protocols packet by packet on every desktop OS.
What it is
Wireshark is the free, open-source network protocol analyzer: it captures live traffic or reads saved capture files and dissects hundreds of protocols into a readable, filterable three-pane view on Windows, macOS and Linux.
Editor's review
Long-form introduction by the BetterPicker editors · checked against the official site · Oct 30, 2026
Wireshark is the packet-level microscope every network story eventually reaches for, and its tutorial ecosystem reflects that permanence. Vinsloev Academy's ten-minute primer (1,698,366 views) remains the standard on-ramp: install from wireshark.org, capture on your active interface, and read the color-coded protocol breakdown of a single web request. Anson Alexander's beginner course (1,289,103 views) extends that into filters and following streams, Hacker Joe's long-form tutorial (864,399 views) goes deeper into scan detection, PC Security Channel demonstrates the security-investigation angle (309,154 views), and Chris Greer's short on the three filters professionals actually type (295,758 views) is the cheat sheet working engineers share. The tool itself is free and open source under the GPL, with the current stable release freshly cut from the newest branch and older lines still shipping fixes. Under the hood it dissects hundreds of protocols - from Ethernet and TCP through TLS, DNS, QUIC and modern application traffic - into three linked panes that connect wire-level bytes to packet details to a plain-language summary. Capture and display filters form a language of their own, sharpened by follow-stream reconstruction, expert-information warnings and IO-graph statistics. It runs on Windows, macOS and Linux, opens captures recorded by other tools, and the companion Stratoshark project now applies the same interface to system-call logs. The interface has stayed remarkably stable for two decades, which is why tutorials from years back still map one-to-one onto the modern app - a rarity in networking tooling. Rotation matters too: capture filters decide what hits disk before a busy link fills it, and ring buffers keep long investigations within disk budgets. There is no paid tier: the Wireshark Foundation sustains development through donations and the annual SharkFest conference, and the release cadence has stayed steady for years.
What it does well
Protocol depth is unmatched: hundreds of dissectors turn binary captures into readable trees, updated constantly by an active developer community.
The filter language rewards learning: one precise display filter isolates the conversation that matters inside a noisy capture in seconds.
It is the shared lingua franca: capture files open anywhere, which is why job postings, courses and certifications simply assume it.
Who it's for
Network engineers diagnosing latency and packet loss, security analysts reconstructing incidents, and developers debugging APIs and protocols at the wire level. Beginners get a two-decade tutorial library for free, starting with the ten-minute primer above.
Where it falls short
It observes, it does not block: Wireshark is analysis only, so enforcement and intrusion prevention need a different class of tool.
Encrypted traffic hides payloads: it shows TLS handshakes and metadata, not decrypted application data, unless you supply session keys.
High-volume captures demand care: full captures on busy links grow fast, and capture filters plus ring buffers are required technique on production networks.
Specs at a glance
Facts from the official site · not editorial opinion
| Latest version | 4.6.9 (stable branch 4.6; 4.4 and older branches in maintenance) |
|---|---|
| Price | Free and open source; no paid tier |
| Platforms | Windows, macOS, Linux (packages and source); capture files portable across platforms |
| Open source | Yes - GNU GPL (Wireshark Foundation project) |
| Core capability | Live capture and offline analysis, deep dissection of hundreds of protocols, display and capture filter language, follow-stream reconstruction, expert info, IO graphs and statistics |
| Integrations | Reads pcap/pcapng from other tools, Lua and C dissector plugins, remote capture via sshdump/sshdump-style extcap, Stratoshark sibling project for system-call logs |
| Best for | Packet-level network troubleshooting, security investigation and protocol development |
Frequently asked questions
▸Is Wireshark free?
Yes. It is open source under the GPL, with all features available at no cost. The Wireshark Foundation funds development through donations and SharkFest.
▸Can Wireshark see passwords in HTTPS traffic?
Not by default. TLS encrypts application data, so you see handshakes and metadata unless you decrypt with session keys you export from the browser or server.
▸What is the difference between capture and display filters?
Capture filters decide what gets recorded at all (tcpdump syntax); display filters narrow what you look at inside the capture. Learning both is the core skill the tutorials teach.
▸Which Wireshark version should I install?
The current stable branch - 4.6.9 as of now - from wireshark.org. Older branches like 4.4 keep receiving maintenance fixes for deployments that need stability over features.
Video reviews
4 review videos aggregated · praise and criticism included alike · click through to the original video
Channels that covered it
Channels are aggregated as sources only — we don’t rate creators
Related tools
Where to go next
External links open in a new tab; external content is independent of this site.
Link down? Every object page is re-checked monthly.