Wireshark
Wireshark Foundation · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
The standard open-source packet analyser, with a GUI, the tshark command-line equivalent, several thousand protocol dissectors, and a display filter language. It is published by the Wireshark Foundation, which also runs the SharkFest conferences.
Who it is for, and when
Wireshark is where you go to read a capture packet by packet — following a TCP stream, confirming what a host actually sent, extracting a transferred file from the bytes on the wire, or checking whether traffic was encrypted. In expert work it is invaluable precisely because it shows the raw bytes alongside the interpretation, so a disputed claim about network activity can be taken down to the octet. tshark makes the same dissectors available for scripted processing of large capture sets.
What it does not cover
Wireshark reads captures; it does not tell you what was not captured, and it is a poor tool for summarising large volumes — a multi-gigabyte PCAP is a job for Zeek logs, with Wireshark reserved for the specific conversations that matter. It cannot decrypt TLS without keys, does not reconstruct sessions across gaps in a capture, and offers nothing for endpoint or disk evidence.
Go to the source
Open at wireshark.org (opens in a new tab)https://www.wireshark.org/docs/
Details
- Type
- Tool
- Written for
- New to the fieldWorking examinerAdvancedNew to the field, Working examiner, Advanced
- Publisher
- Wireshark Foundation
- Year
- 2026
- Topics
- network, malware, open-source, incident-response
- Checked at source
Related entries
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs — connections, HTTP requests, DNS queries, TLS handshakes, files seen — using its own scripting language. Suricata, from OISF, is a signature and rule-driven IDS/IPS that also produces rich EVE JSON records and can extract files.
CyberDefenders
Partly freeA blue-team lab platform hosting scenario-based investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat hunting, detection engineering and threat intelligence. Challenges are question-and-answer over supplied evidence, with a scoreboard.
A daily handler diary — distinct from the SANS DFIR blog — in which a rotating roster of volunteer handlers writes up whatever they are currently seeing in honeypot data, malware samples, exploit traffic and log telemetry.
Volatility 3
FreeAn open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.
Blue Team Labs Online
Partly freeA gamified platform, run by Centri, of "security investigations and challenges covering; Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting". Challenges are downloadable artefacts — memory dumps, phishing emails, packet captures, logs — while investigations run in hosted lab instances.