In one sentence: Wireshark is a free program that records the traffic on a network and shows it in detail, so an IT person can see exactly what devices are saying to each other.

What it is

Wireshark is a network packet analyser. A packet is a small chunk of data sent across a network. The Wireshark user guide compares the tool to a voltmeter that an electrician uses to see what is happening inside a cable.

It is free and open source. Its own site describes it as inspecting hundreds of protocols deeply, with live capture and offline analysis, and it runs on Windows, Linux, macOS and other systems. The site also mentions a command-line utility called TShark.

The guide says network administrators use it to troubleshoot problems and security engineers use it to examine security problems.

How it works

1. Capture. Wireshark listens on a network interface and records packets. The guide notes that you may need special privileges, you must choose the right interface, and you must capture at the right place in the network to see the traffic you want.
2. Decode. It breaks each packet into labelled parts using protocol knowledge, so you can read a DNS question, a web request or a login exchange.
3. Filter. Display filters narrow the view to one device, port or protocol.
4. Analyse and save. You can follow a conversation, produce statistics and save captures to open later.

What it does not do: the guide says Wireshark is not an intrusion detection system and will not warn you when someone does something strange. It only measures, and does not send packets or manipulate the network.

Who it affects and how badly

Wireshark is a defender’s tool, but anyone can download it, and what it shows matters to everyone.

• Sole trader to 10 staff: an IT adviser might use it to find why a device is slow or sending traffic to strange places.
• 10 to 50 staff: an MSP uses it to prove whether a login travels in clear text.
• Regulated businesses: captures can contain personal data and passwords. Treat capture files as sensitive, and capture only on networks you own or are authorised to test.

Real examples

• Seeing a clear text protocol. RFC 2577 states that standard FTP sends passwords in clear text and sends all data and control information unencrypted. A capture of an FTP session in Wireshark makes that visible, which is why it is useful evidence when asking a supplier to move to an encrypted option.
• Keeping the tool updated. The Wireshark project publishes advisories for releases that fix serious vulnerabilities, such as crashes in protocol dissectors, and says to consider upgrading if you run a vulnerable version.

How to detect it

This section covers what Wireshark helps you spot, and how to spot misuse of capture.

• Clear text logins. Filter for protocols such as FTP, Telnet and plain HTTP, and check whether credentials appear unencrypted.
• Unexpected destinations. Check which external addresses a device talks to and whether the volume is normal. Unusual outbound volumes are one sign of data exfiltration.
• Unauthorised capture. MITRE notes that traffic mirroring is a native feature of some devices, and attackers can abuse it to copy traffic. Review switch and router mirroring settings for ones you did not set up.

How to fix or prevent it

1. Fix what a capture reveals: replace clear text protocols with encrypted ones.
2. Capture with permission, on your own network, and for a stated purpose.
3. Store capture files securely, restrict who can open them, and delete them when finished.
4. Keep Wireshark updated, and open captures from untrusted sources only in a controlled environment.
5. Use encryption in transit so a captured packet is not readable.

Related terms

• nmap
• port 23 telnet
• port 20 21 ftp
• port 53 dns
• indicators of compromise
• vulnerability scanning

Frequently asked questions

Is Wireshark free?
Yes. Wireshark says it is available for free and is open source.

Do I need special permissions to capture traffic?
The user guide says you may need special privileges, and you should capture only on networks you own or are authorised to test.

Can Wireshark show passwords?
It can show a login if the protocol sends it unencrypted. RFC 2577 says standard FTP sends passwords in clear text.

Sources

• Wireshark User’s Guide, chapter 1 Introduction: https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html
• Wireshark User’s Guide, chapter 4 Capturing Live Network Data: https://www.wireshark.org/docs/wsug_html_chunked/ChapterCapture.html
• Wireshark: About: https://www.wireshark.org/about.html
• Wireshark security advisories: https://www.wireshark.org/security/
• RFC 2577, FTP Security Considerations: https://www.rfc-editor.org/rfc/rfc2577.txt
• MITRE ATT&CK Exfiltration tactic (traffic duplication): https://attack.mitre.org/tactics/TA0010/

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.