In computing, Wireshark is a free software protocol analyzer, or "packet sniffer" application, used for network troubleshooting, analysis, software and protocol development, and education. It has all of the standard features of a protocol analyzer. Wireshark was created as a fork of Ethereal due to trademark issues.
The functionality Wireshark provides is very similar to tcpdump (c.f.), but it has a GUI front-end, and many more information sorting and filtering options. It allows the user to see all traffic being passed over the network (usually an Ethernet network but support is being added for others) by putting the network card into promiscuous mode.
Wireshark is released under the GPL open-source license, and it uses the cross-platform GTK+ widget toolkit. It runs on Unix and Unix-like systems, including Linux, Solaris, FreeBSD, NetBSD, OpenBSD and Mac OS X (although GTK+ only works with X11 on Mac OS X, so the user will need to run an X server such as X11.app), and on Windows.
Wireshark is software that "understands" the structure of different network protocols. Thus it's able to display encapsulation and single fields and interpret their meaning. Wireshark uses pcap to capture packets, so it can only capture on networks supported by pcap
History
Out of necessity, Gerald Combs (a computer science graduate of the University of Missouri-Kansas City) started writing a program called Ethereal so that he could have a tool to capture and analyze packets; he released the first version around 1998. Pretty soon, this GPLed protocol analyzer caught on. As of now there are over 500 contributing authors while Gerald continues to maintain the overall code and issues releases of new versions. The entire list of authors is available from Wireshark's web-site.
The name was changed to Wireshark in June, 2006, because creator and lead developer Gerald Combs could not keep using the Ethereal trademark (which was then owned by his old employer, Network Integration Services) when he changed jobs. He still held copyright on most of the source code (and the rest was redistributable under the GNU General Public License), so he took the Subversion repository for Ethereal and used it as the basis for the Subversion repository of Wireshark.
It appears that Ethereal development has ceased, and an Ethereal security advisory recommended switching to Wireshark.
Features
Data can be captured "from the wire" from a live network connection or read from a capture file.
Live data can be read from Ethernet, FDDI, PPP, token ring, IEEE 802.11, Classical IP over ATM, and loopback interfaces (at least on some platforms; not all of those types are supported on all platforms).
Captured network data can be browsed via a GUI, or via the TTY-mode "tshark" program.
Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
Display filters can also be used to selectively highlight and color packet summary information.
Data display can be refined using a display filter.
Hundreds of protocols can be dissected.
The terminal (command line) version of the utility is Tshark.
Security
Capturing raw network traffic from an interface requires special privileges on some platforms. For this reason, Wireshark often runs with superuser privileges (even on platforms where capturing raw network traffic doesn't require that
Taking into account the huge number of protocol dissectors, which are called when traffic for their protocol is captured, this can pose a serious security risk given a bug in a dissector. Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developer's doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to its 3.6 release.
One possible alternative is to run tcpdump, or the dumpcap utility that comes with Wireshark, with superuser privileges to capture packets into a file, and later analyze these packets by running Wireshark with restricted privileges on the packet capture dump file.