Wiresharkfor Windows, macOS, Linux

Wireshark is the tool you open when something on the network is misbehaving and you need to see exactly what the machines are saying to each other. It is a packet analyzer — it captures the actual traffic flowing across a link and lets you read it, byte by byte if you want. It is maintained by the Wireshark Foundation with a large community of contributors. Here is the honest framing: if your question is “which devices are on my network,” Wireshark is the wrong tool. If your question is “why is this connection failing, slow, or behaving strangely,” it is one of the best free tools ever made.

For corporate network administrators, Wireshark is the go-to tool when a problem sits below the surface: intermittent timeouts between application servers, DNS misconfigurations silently slowing down logins, or a misbehaving VLAN that only fails under load. By capturing and decoding the actual packets, it lets the admin see exactly where a conversation breaks down — a retransmission storm, a misconfigured MTU, a certificate handshake that never completes — and turn a mysterious symptom into a concrete fix.

What Wireshark actually does

Wireshark captures packets from a network interface and decodes them into something a human can read. It understands hundreds of protocols, so a raw stream of bytes becomes a readable list: this was a DNS lookup, that was a TCP handshake, here is an HTTP request and the response that came back.

The real power is in its display filters — a rich filtering language that lets you narrow thousands of captured packets down to just the conversation you care about, say all traffic to one IP on one port, or every packet where a TCP reset appeared. You can follow a single conversation end to end, inspect timing, spot retransmissions, and export what you find. For headless or scripted work there is tshark, the command-line version that captures and filters the same way without the GUI.

How administrators use it

Diagnosing intermittent application timeouts. When an internal web application sporadically takes ten seconds to respond and the application team blames the network, start a capture on the server’s interface filtered to that application’s port. Look for TCP retransmissions, duplicate ACKs, or long gaps between the request and the first response byte. The timestamps in Wireshark’s conversation view pinpoint whether the delay is on the wire or inside the application — ending the blame game with evidence.

Troubleshooting DNS resolution failures. Users report that “the internet is slow” but only for certain sites. Capture on the client’s workstation with a display filter for DNS (udp.port == 53). Within seconds you can see whether queries are going to the right server, whether responses are arriving at all, and whether NXDOMAIN or SERVFAIL answers point to a misconfigured forwarder or a stale record.

Verifying VLAN tagging and trunk configuration. After rearranging switch trunks, capture on the trunk port (via a mirror or tap) and filter for 802.1Q tags. Wireshark decodes the VLAN ID in each frame, so you can confirm that traffic is tagged into the correct VLANs and that untagged traffic is landing where it should — a faster check than logging into every switch to read the running config.

Investigating a suspected rogue DHCP server. When workstations suddenly get wrong IP addresses, capture DHCP traffic (bootp filter) and look at the Offer packets. Wireshark shows the server identifier field in each offer, so you can immediately see the MAC and IP of every device handing out leases — including the unauthorized one — and trace it on the switch.

Where it shines

Nothing else shows you the truth of the wire like Wireshark. When an application vendor says “it’s your network” and your network team says “it’s the application,” a capture settles the argument. You can see whether a request even left the building, whether the other end answered, and how long every step took.

Its protocol coverage is enormous and its decoding is trustworthy, which matters when you are trying to understand an unfamiliar protocol or a subtle handshake problem. The filtering language, once you learn a handful of expressions, turns an overwhelming capture into a focused investigation in seconds. And because it is free and cross-platform, you can keep it on every technician’s laptop without a licensing conversation.

Where it falls short

It assumes you already know a bit about how networks work. Wireshark will happily show you a million packets; making sense of them requires understanding TCP, DNS, and the protocols in play. For a newcomer, the first capture is intimidating.

It only sees what it can capture. On a modern switched network you often need to configure port mirroring, tap the right link, or capture on the affected machine itself — otherwise you are staring at your own laptop’s traffic and nothing else. That setup step trips people up constantly.

Encryption limits what you can read. More and more traffic is TLS-encrypted, so you can see that a conversation happened and how it flowed, but not the contents unless you have arranged to decrypt it. And captures can hold sensitive data, so they need to be handled and stored carefully.

Who it’s for

Wireshark is for the person doing hands-on troubleshooting: the developer chasing an API that intermittently times out, the admin diagnosing slow file transfers, the one-person IT department trying to prove where a fault actually lives. It is a diagnostic instrument, not a routine housekeeping tool. If you mainly want an inventory of connected devices or a quick “is this host up” check, this is not the tool to start with — you want a scanner instead.

Licensing and cost

Wireshark is free and open-source, released under the GNU General Public License, version 2 (GPLv2). You can install it across your organization at no cost and under the terms of that license. There is no paid tier to unlock features; the whole thing is there from the first install.

How it compares

The most important comparison is a contrast, not a rivalry. Nmap answers “what hosts and services exist here” by actively probing; Wireshark answers “what is actually being said on the wire” by passively listening. They sit at opposite ends of the workflow, and plenty of admins use one to find a problem area and the other to dissect it.

If your real need is discovery rather than deep inspection, Angry IP Scanner gives you a fast, friendly list of live hosts and open ports across Windows, macOS, and Linux. On Windows, Advanced IP Scanner adds device discovery with shared folders and remote actions. None of those read packet contents — that remains Wireshark’s job.

Getting it safely

Get Wireshark from the Wireshark Foundation’s official site (wireshark.org) or a trusted package repository. We are an independent review portal — we host nothing and offer no installers of our own. Analyzer tools are a common target for tampered copies, so confirm you have the genuine file first: our short guide covers how to verify a download. And a reminder on the ethics of capture — record only traffic on networks you own or have written permission to inspect, since packets can contain other people’s data; our authorization checklist walks through getting that permission straight.

How to verify what you got. The Wireshark project publishes SHA-256 checksums for every release on its official site. After obtaining the installer, compare its hash (on Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256; on macOS/Linux: shasum -a 256). On Windows the installer is also code-signed by the Wireshark Foundation — right-click the .exe, open Properties → Digital Signatures, and confirm the signer is “Wireshark Foundation” with a valid certificate chain. On Linux, installing from your distribution’s official repository (apt, dnf) lets the package manager verify the GPG signature automatically. If the hash does not match or the signature is missing, do not run the file.

FAQ

Can Wireshark scan my network to list all my devices? Not really. It is a passive analyzer — it reads traffic that reaches the interface it is capturing on. For a list of devices you would use a discovery scanner like Angry IP Scanner or Nmap, then bring Wireshark in to investigate a specific problem.

Why does my capture only show my own computer’s traffic? On a switched network, each device mostly sees only its own traffic. To watch traffic between other machines you typically configure port mirroring on the switch, use a network tap, or capture directly on the affected host.

Can it read encrypted (HTTPS) traffic? By default, no. You will see that an encrypted conversation took place and how it flowed, but not its contents unless you have specifically set up decryption with the right keys, which is an advanced and access-controlled task.