What is Wireshark?
Wireshark captures the traffic running across a network and lets you inspect it protocol by protocol, rather than showing you a summary of connections. It understands hundreds of protocols, can capture live or read a saved capture file, and ships as a graphical application alongside command-line tools including TShark and dumpcap. It is free software under the GNU General Public License version 2, and the vendor states the download is the full version rather than a limited demo. It is maintained by the non-profit Wireshark Foundation and runs on macOS, Windows, Linux and UNIX. It suits network engineers, security analysts and developers who need to see what is actually on the wire.
Verified product facts
- Type
- network protocol analyserEditorially reviewed
- Platform
- macOS
- Pricing
- Open sourceDeveloper-stated
- Open source
- Yes
- Developer
- The Wireshark FoundationDeveloper-stated
- Relationship to Nuanyue
- Third-party product — not published by NuanyueEditorially reviewed
- Licence
- GPL-2.0
- Current version
- 4.6.9Developer-stated
- Official website
- www.wireshark.org/
Last updated . Facts marked developer-stated come from the developer and are not independently confirmed; editorially reviewed marks a Nuanyue judgement.
Key features
What Wireshark does at a glance.
Captures live traffic and lets you browse it interactively
Deep inspection of hundreds of network protocols
Graphical application
Plus command-line tools including TShark and dumpcap
Display filter reference
Covering every filter from version 1.0.0 onward
Offline analysis of previously captured files
Available
In more than 20 languages
Runs on macOS, Windows, Linux and UNIX
A universal macOS disk image is published
For the current stable release
What you can use Wireshark for
- Diagnosing why a connection is slow or failing
- Inspecting exactly what an application sends over the network
- Analysing a capture file someone else recorded
- Scripting packet analysis through the command-line tools
Who is Wireshark for?
- Network engineers and administrators troubleshooting live problems
- Security analysts examining traffic for anomalies
- Developers who need to see the actual bytes their code puts on the wire
Who is Wireshark not for?
- Anyone who needs a tool that explains a network problem in plain language — Wireshark shows you packets, not conclusions
- Users who need to debug HTTPS request and response bodies easily, which is the job of an intercepting proxy rather than a packet analyzer
Limitations
- Analysing encrypted traffic is limited to what the capture exposes; decryption requires keys that Wireshark does not obtain for you
- Capturing on macOS requires elevated privileges or additional configuration for the capture interface
- Apple Silicon support is not stated in the sources Nuanyue tracks, though the vendor publishes a universal disk image
Strengths and trade-offs
What Wireshark does well, and what to weigh before choosing it. Points marked developer-stated come from the developer’s own material and have not been independently confirmed.
Strengths
- Performs deep inspection of hundreds of network protocols rather than summarising connections.Developer-stated
- Ships both a graphical application and command-line tools such as TShark and dumpcap.Developer-stated
- Is genuinely free software under the GPL version 2, with the full version published rather than a demo.
- Maintained by a non-profit foundation rather than a single commercial vendor.
- Publishes a complete display filter reference covering every version from 1.0.0 onward.Developer-stated
Trade-offs
- It shows raw packets rather than conclusions, so interpreting the output requires protocol knowledge.Editorially reviewed
- Inspecting encrypted traffic is only possible to the extent the capture provides the means to decrypt it.Editorially reviewed
- The minimum macOS version is not stated in the sources Nuanyue tracks.Editorially reviewed
First-use experience
What the app asks of you when you set it up. Only established facts appear here; anything we could not confirm is left out rather than guessed at.
- Installation
- A macOS universal disk image is published on the download page; packages also exist for Windows and Linux.
- First launch Derived
- Select a network interface to capture on; no account or sign-in is involved.
- System integration Developer-stated
- Captures at the network interface level, so it observes traffic from every application rather than a single one.
What it does
Wireshark records what is actually on the network and lets you take it apart. Where most network tools report a connection — who talked to whom, how much data moved — Wireshark decodes the conversation itself, understanding hundreds of protocols so that you can read individual fields rather than a hex dump.
It works two ways: capturing live from a network interface, or opening a capture file recorded elsewhere. The graphical application is accompanied by command-line tools including TShark and dumpcap, which is how most automated analysis is done.
Licensing and who runs it
Wireshark is free software under the GNU General Public License version 2. The project is explicit that the download is the full version rather than a demo with features withheld, and that there is no licence fee. It is maintained by the Wireshark Foundation, a non-profit funded by donations and sponsors, which is relevant if you are choosing a tool whose long-term availability matters.
What it is not
Wireshark shows packets, not conclusions. Interpreting a capture requires knowing what the protocols should look like, which is why it is a specialist tool rather than a general diagnostic assistant. It is also not an intercepting proxy: for reading HTTP request and response bodies, a tool such as Charles or Proxyman is the right instrument. Encrypted traffic can be examined only to the extent the capture provides the keys to decrypt it.
Questions about Wireshark
Is Wireshark free?
Yes. Wireshark is free software under the GNU General Public License version 2, and the vendor states that the download is the full version rather than a demo with features removed.
Which platforms does Wireshark support?
It runs on most computing platforms including Windows, macOS, Linux and UNIX, and can be built from source on others.
Does Wireshark have a command-line version?
Yes. The project publishes command-line tools including TShark and dumpcap alongside the graphical application, with UNIX-style manual pages for each.
Who maintains Wireshark?
It is maintained by the Wireshark Foundation, a non-profit organisation funded by donations and sponsors rather than by selling licences.
Similar apps
Related in purpose, but not a straight swap.
Charles
Cross-platform HTTP and HTTPS debugging proxy.
Both inspect network traffic in detail, but Charles is an intercepting proxy that decrypts and presents HTTP requests while Wireshark captures packets at the interface level.
Proxyman
Native macOS HTTP debugging proxy with HTTPS decryption.
Both are used to see what an application sends over the network, but Proxyman focuses on HTTP debugging through a proxy while Wireshark works across all protocols.
mitmproxy
Open-source interactive HTTPS proxy, scriptable in Python.
Both are free tools for inspecting traffic, but mitmproxy is a scriptable intercepting proxy for HTTP while Wireshark is a packet capture and protocol analyzer.
Works well with
Not a replacement — apps commonly used alongside this one.
Little Snitch
Application firewall that approves or blocks every outgoing connection.
Little Snitch decides which connections your Mac may make, and Wireshark shows in detail what those connections actually carry.
Links
Sources
Facts on this page are checked against the sources below. Last updated .
