This article presents Wireshark, a very capable and popular graphical network protocol analyser.

Gerald Combs created Ethereal, the ancestor of WireShark, back in 2006. When he changed his job, he could not use the name Ethereal any more, so he renamed his software WireShark. Nowadays, most people only know WireShark! The main advantage of WireShark is that it is a graphical application. There is also a command-line version of WireShark but I have never used it.

You can get WireShark either from its website—by compiling its source code—or directly from your Linux distribution. I personally prefer the second option. the protocol, whereas the body part contains the data. Some protocols are reliable, whereas others are not, which means they do not guarantee package delivery—this is not always a problem, but the application must deal with it, if required.

WireShark captures packets, and analyses and displays them in a human-readable format. WireShark allows you to follow a TCP/IP ‘conversation’ between two machines, view packet data, etc. Before you start capturing, it is better to have in mind a particular issue that you want to solve or examine. What follows DUH WhH LnLWLDO sWHSs WRwDUGs sXFFHssIXO nHWwRUN WUDIfiF DnDOysLs.