Use with authorization only. Scan networks and hosts you own or have explicit written permission to assess. Unauthorized scanning can violate acceptable-use policies and, in some jurisdictions, the law.

Wireshark is the tool you open when something on the network is misbehaving and you need to see exactly what the machines are saying to each other. It is a packet analyzer — it captures the actual traffic flowing across a link and lets you read it, byte by byte if you want. It is maintained by the Wireshark Foundation with a large community of contributors. Here is the honest framing: if your question is “which devices are on my network,” Wireshark is the wrong tool. If your question is “why is this connection failing, slow, or behaving strangely,” it is one of the best free tools ever made.

What Wireshark actually does

Wireshark captures packets from a network interface and decodes them into something a human can read. It understands hundreds of protocols, so a raw stream of bytes becomes a readable list: this was a DNS lookup, that was a TCP handshake, here is an HTTP request and the response that came back.

The real power is in its display filters — a rich filtering language that lets you narrow thousands of captured packets down to just the conversation you care about, say all traffic to one IP on one port, or every packet where a TCP reset appeared. You can follow a single conversation end to end, inspect timing, spot retransmissions, and export what you find. For headless or scripted work there is tshark, the command-line version that captures and filters the same way without the GUI.

Where it shines

Nothing else shows you the truth of the wire like Wireshark. When an application vendor says “it’s your network” and your network team says “it’s the application,” a capture settles the argument. You can see whether a request even left the building, whether the other end answered, and how long every step took.

Its protocol coverage is enormous and its decoding is trustworthy, which matters when you are trying to understand an unfamiliar protocol or a subtle handshake problem. The filtering language, once you learn a handful of expressions, turns an overwhelming capture into a focused investigation in seconds. And because it is free and cross-platform, you can keep it on every technician’s laptop without a licensing conversation.

Where it falls short

It assumes you already know a bit about how networks work. Wireshark will happily show you a million packets; making sense of them requires understanding TCP, DNS, and the protocols in play. For a newcomer, the first capture is intimidating.

It only sees what it can capture. On a modern switched network you often need to configure port mirroring, tap the right link, or capture on the affected machine itself — otherwise you are staring at your own laptop’s traffic and nothing else. That setup step trips people up constantly.

Encryption limits what you can read. More and more traffic is TLS-encrypted, so you can see that a conversation happened and how it flowed, but not the contents unless you have arranged to decrypt it. And captures can hold sensitive data, so they need to be handled and stored carefully.

Who it’s for

Wireshark is for the person doing hands-on troubleshooting: the developer chasing an API that intermittently times out, the admin diagnosing slow file transfers, the one-person IT department trying to prove where a fault actually lives. It is a diagnostic instrument, not a routine housekeeping tool. If you mainly want an inventory of connected devices or a quick “is this host up” check, this is not the tool to start with — you want a scanner instead.

Licensing and cost

Wireshark is free and open-source, released under the GNU General Public License, version 2 (GPLv2). You can install it across your organization at no cost and under the terms of that license. There is no paid tier to unlock features; the whole thing is there from the first install.

How it compares

The most important comparison is a contrast, not a rivalry. Nmap answers “what hosts and services exist here” by actively probing; Wireshark answers “what is actually being said on the wire” by passively listening. They sit at opposite ends of the workflow, and plenty of admins use one to find a problem area and the other to dissect it.

If your real need is discovery rather than deep inspection, Angry IP Scanner gives you a fast, friendly list of live hosts and open ports across Windows, macOS, and Linux. On Windows, Advanced IP Scanner adds device discovery with shared folders and remote actions. None of those read packet contents — that remains Wireshark’s job.

Getting it safely

Get Wireshark from the Wireshark Foundation’s official site (wireshark.org) or a trusted package repository. We are an independent review portal — we host nothing and offer no installers of our own. Analyzer tools are a common target for tampered copies, so confirm you have the genuine file first: our short guide covers how to verify a download. And a reminder on the ethics of capture — record only traffic on networks you own or have written permission to inspect, since packets can contain other people’s data; our authorization checklist walks through getting that permission straight.

FAQ

Can Wireshark scan my network to list all my devices? Not really. It is a passive analyzer — it reads traffic that reaches the interface it is capturing on. For a list of devices you would use a discovery scanner like Angry IP Scanner or Nmap, then bring Wireshark in to investigate a specific problem.

Why does my capture only show my own computer’s traffic? On a switched network, each device mostly sees only its own traffic. To watch traffic between other machines you typically configure port mirroring on the switch, use a network tap, or capture directly on the affected host.

Can it read encrypted (HTTPS) traffic? By default, no. You will see that an encrypted conversation took place and how it flowed, but not its contents unless you have specifically set up decryption with the right keys, which is an advanced and access-controlled task.

Guides

Wireshark Display Filters: A Practical Reference

About the project

Wireshark is developed and maintained by Wireshark Foundation. This is an independent catalog — we don't host or distribute the software. For source code, documentation and official releases, see the project's own site.