New protocols can be scrutinized by creating plug-ins.

Display filters are used to filter and organize the data display.

For programmatically editing and converting the captured files to the editcap application, users can use command line switches.

With the help of GUI or other versions, users can browse captured data networks.Supports live data reading and analysis for a wide range of networks (including Ethernet, IEEE 802.11, point-to-point Protocol (PPP) and loopback).Data is analyzed either from the wire over the network connection or from data files that have already captured data packets.

In addition, Wireshark permits the user to see all the traffic being passed over the network. The difference is that it supports a graphical user interface (GUI) and has information filtering features. Wireshark shares many characteristics with tcpdump. Wireshark and other terminal-based free software versions like Tshark are released under the GNU General Public License. The analyzer operates on Unix, Linux and Microsoft Windows operating systems, and employs the GTK+ widget toolkit and pcap for packet capturing. It is used to analyze the structure of different network protocols and has the ability to demonstrate encapsulation. Wireshark is a network or protocol analyzer (also known as a network sniffer) available for free at the Wireshark website. Wireshark is used in many educational institutions and other industrial sectors.

Many networking developers from all around the world have contributed to this project with network analysis, troubleshooting, software development and communication protocols.

The wireshark network analyzer