Can read the Live data from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others.

Capture files compressed with gzip can be decompressed on the fly.

Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others Also Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor. Microsoft Network Monitor, Network General Sniffer, Sniffer Pro, and NetXray.

Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog.

The most powerful display filters in the industry.

Can browse the captured network data via a GUI, or via the TTY-mode TShark utility.

Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others

Deep inspection of hundreds of protocols, with more being added all the time.

Simple passive taps are extremely resistant to malware tampering.

Port mirroring or various network taps extend capture to any point on net. So capturing in promiscuous mode will not necessarily be sufficient to see all traffic on the network. However, when capturing with a packet analyzer in promiscuous mode on a port on a network switch, not all of the traffic traveling through the switch will necessarily be sent to the port on which the capture is being done. Wireshark allows the user to put the network interfaces that support promiscuous mode into that mode, in order to see all traffic visible on that interface, not just traffic addressed to one of the interface’s configured addresses and broadcast/ multicast traffic. In addition, some integrated sorting and filtering options. Wireshark is very similar to tcpdump, but has a graphical front-end. It is the de facto (and often de jure) standard across many industries and educational institutions. It is cross-platform, using the GTK+ widget toolkit to implement its user interface, and using pcap to capture packets. The program lets you capture and interactively browse the traffic running on a computer network.

You can use it for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is the world’s foremost network protocol analyzer.

Wireshark 4.0.7 for mac instal free