security enabled verified medium v1.0.0

Wireshark

World's most popular network protocol analyzer for live traffic capture and offline pcap analysis with deep inspection of hundreds of protocols.

📋 Live Preview 
wireshark -i {interface} -k
🌍 interface → eth0 
wireshark -i {interface} -k

Sandbox: execFile · Timeout: 86400s

Capabilities

network.sniff.packet
network.analyze.protocol
network.capture.live
network.capture.offline
security.forensics.pcap
network.filter.display
network.filter.capture

Parameters

Name Type Required Default Description Aliases
interface string No - Network interface to capture on -i, --interface
read-file file No - Read packet data from pcap file -r, --read-file
start-capture boolean No - Start capturing immediately -k
write-file file No - Write captured packets to file -w, --write-file
capture-filter string No - Capture filter expression (pcap-filter syntax) -f
display-filter string No - Display filter expression -Y, --display-filter
packet-count integer No - Stop after capturing count packets -c
output-format string No - Output format (fields, pdml, psml, json) -T, --output-format
verbose boolean No - Verbose output -V
hex boolean No - Display hex dump of packet data -x
quiet boolean No - Suppress packet output -q
list-interfaces boolean No - List available network interfaces -D, --list-interfaces
S boolean No - Update packet display as capture progresses. -S
b boolean No - ringbuf Set ring buffer options. -b
h boolean No - Display help and exit. -h

Contract

Inputs

network.interface

Network interface to capture on

file.pcap

PCAP file for offline analysis

Outputs

file.pcap

Captured packet data

network.analysis.json

Parsed packet analysis output

Side effects: network_trafficraw_socket_access

Workflow Edges

Produces

file.pcapnetwork.analysis.json

Consumes

network.interfacefile.pcap

Resource Profile

ResourceValue
CPUmedium
Memory256 MB
Networkhigh
Disk I/Ohigh

Examples

Start live capture on eth0

wireshark -i eth0 -k

Analyze offline pcap file

wireshark -r capture.pcap

Capture with display filter for HTTP traffic

wireshark -i eth0 -k -Y "http"

Write capture to output file

wireshark -i eth0 -w output.pcap -k

Capture with BPF filter for port 80 only

wireshark -i eth0 -f "port 80" -k

List available capture interfaces

wireshark -D

Open pcap with specific display filter

wireshark -r capture.pcap -Y "tcp.port==443"

Documentation

Wireshark — Network Protocol Analyzer

Wireshark is the world's foremost network protocol analyzer, enabling live capture and offline inspection of hundreds of protocols. It provides deep packet inspection, advanced filtering, and rich analysis capabilities for network troubleshooting, security analysis, and forensic investigation.

Capture Modes

Mode Command Description
Live wireshark -i eth0 -k Capture live traffic on interface
Offline wireshark -r file.pcap Analyze existing pcap file
Filtered wireshark -f "port 80" Capture with BPF filter

Display Filters

Wireshark display filters are powerful expressions for isolating packets of interest:

  • http — Show only HTTP traffic
  • tcp.port == 443 — Show traffic on port 443
  • ip.addr == 10.0.0.1 — Filter by IP address
  • dns.qry.name contains "example" — DNS query filtering
  • tcp.flags.syn == 1 and tcp.flags.ack == 0 — SYN packets only

Protocol Support

Wireshark decodes hundreds of protocols including TCP/IP, HTTP, DNS, TLS, SMB, DHCP, ARP, ICMP, SNMP, FTP, SSH, Kerberos, and many more. Protocol dissection can be extended via Lua plugins.

Related Tools

tcpdumptsharkettercap

References