Wireshark is often compared to a flashlight – a handy tool that lets you see what you're doing more clearly, and is pretty indispensable if you're going to be fixing a car at night or exploring a wooded area. The above can all seem rather complicated if you're new to Wireshark or networking. Wireshark users can also decide how to dissect protocols and create plug-ins if they're like to dissect a new protocol that's not currently supported. The majority of these are old and unpopular, but TCP, UDP, and ICMP are fully supported, allowing for the analysis of IP packets. Wireshark currently supports thousands of protocols. Wireshark also allows users to visualize network streams and create statistics. You'll be able to zero in on what interests you and colorize your packet display. That's a lot of information! Fortunately, Wireshark comes loaded with various filters that make it possible to make sense of all this data. And, as an extra cherry-on-top, a user can trace VoIP calls made over the network when analyzing captured traffic. What's more, the tool is also capable of reading live data from all sorts of networks: Ethernet, IEEE, 802.11, point-to-point Protocol (PPP) and loopback included. It can capture traffic from a variety of media types, too, like Ethernet, LAN, USB, and Bluetooth. Wireshark can analyze data from the wire, via a live network connection, or analyze data files from packets that have already been captured. This comes in handy when conducting traffic analysis, which can then be used to troubleshoot problems by locating the root source. Once captured, Wireshark lets you monitor your network at a granular level and in real time. A packet is simply a unit of data, and Wireshark catches them as they pass from your device to the internet. Wireshark is the most well-known, and frequently-used, protocol analyzer.

Using wireshark as a forensic tool