Wireshark Reviews

Wireshark's main use case is capturing packets and reviewing the data flow over the network.

Regarding my main use case for Wireshark, it is a great tool and would be one of the best tools available if you work in networks and want to capture packets and see how data is moving and what protocols are working. You can also see the header and everything that is in the packet. You cannot see information that is encrypted, and that is a great thing because if you are looking into the network and want to see what communication is encrypted, Wireshark can show you that as well.

A specific example of when I used Wireshark to capture packets and review data flow involved a call that was not working from India to the US. I installed it on the client PC and reviewed the packet to check how the data was flowing and what issue we were experiencing. Wireshark can show you the RTP packets, which helps us significantly in reviewing and troubleshooting the issue.

My advice to others looking to use Wireshark is to use it only if you are completely sure that your system is not compromised.

The best features that Wireshark offers are everything. Every time I look into Wireshark, I find something new. The ability to capture real-time packets and understand how the packet is working and moving through how many hops and to how many points it reaches makes it a wonderful tool.

The specific feature I use most is capturing packets of real-time communication and seeing how the packet is working. I rely on all the filters it has to check the protocols and see the communication between one end and another end and what the hops in between are, and if there is a proxy, how it behaves. Everything helps us check out the issue and troubleshoot it.

I do not have anything additional to add about the features; everything looks really fine. The graphics are also good, and you can change its graphical features, making it a pretty nice tool. You can also use it with the PCAP file, which is really nice.

Wireshark has positively impacted my organization by giving us the ability to capture packets and see into the network how it is working and what we can clarify about the network, specifically how we can remove many hops in the communication channels.

A specific example of a measurable outcome is that we have a few switches in our network that, when we use Wireshark analysis, we find should not be needed or can be replaced with automatic switches instead of manual switches, such as switches which do not have any active features and only passive switches. That has saved us a lot of time.

Wireshark can be improved if it provides the accessibility of capturing packets from one device that is installed in the network without needing the port-mirrored facility. They could provide something that allows us not to set up port mirroring every single time if we want to capture data for a specific device.

I do not want to add more about the needed improvements; that is all that I need and what I see can be improved.

On a scale of one to ten, I would rate Wireshark a ten. The reason I give it a ten is that it is a great tool, and I do not think there is any tool better than this when it comes to capturing packets.

Regarding Wireshark's AI capabilities, I have not used them, so I cannot comment on that. I have not used the AI feature to assess accuracy and reliability of output, so I cannot provide any thoughts on that.

Wireshark is deployed in my organization as a tool; I have not deployed it over the network as we just use it as a tool whenever needed. It is installed in our system and on our jump servers.

There are no additional improvements needed for Wireshark that we have not discussed yet. I do not have any additional thoughts about Wireshark before we wrap up, as I have told you everything I can about it.

I would rate Wireshark a ten out of ten overall.

I'm using the solution for tasks like identifying top talkers and detecting network congestion. I specifically focus on understanding how the network behaves during short bursts, with sampling intervals ranging from milliseconds to tens or hundreds of milliseconds.

I also work with High Frequency Trading (HFT) and use the solution to address issues related to multicast and pinpoint and analyze any gaps in multicast packaging.

One of the features of Wireshark, which is incredibly valuable, is its ability to provide detailed and representative traffic analysis. It allows me to differentiate between protocols like DCP and UDP and even drill down to specifics, such as identifying potential issues caused by a particular destination IP. Additionally, the solution has proven to be a valuable tool for troubleshooting the issues I encounter since my primary focus is on data switching.

There is a disadvantage when it comes to sampling intervals. While the solution supports sampling as fine as one millisecond, it requires a copy at that interval. My Python script allows me to achieve a granularity of up to ten microseconds, but I can't go beyond that. When dealing with provisioning on both issues, it would be beneficial if I could go down to the microsecond level, if not the nanosecond. Additionally, I've heard from a colleague that Wireshark might be less effective in the voice domain.

I've been using the solution from the start of my career.

The stability of the solution is not great. It takes a hit when dealing with larger files, especially those exceeding the size of around 100 to 150 megabytes. It tends to crash and takes a considerable amount of time to recover—usually crashing after about five minutes. This poses a challenge, particularly when troubleshooting larger issues, as you then need to manually break down the file into smaller chunks for Wireshark to handle it smoothly.

The scalability of the product can be improved. In my team, over 50 of us are using the solution.

The initial setup is straightforward. Anyone starting out or looking to deploy it on your personal PC or machine can do it easily.

I've never personally had to pay for it, making it a highly valuable internet resource that's accessible for use. While they offer some paid versions, our firm has utilized the free version for the past three years.

I'm not aware of any packet capture tool besides Wireshark. As mentioned earlier, I've created my Python tool specifically for sampling. This tool allows me to load packet captures, identifying top talkers and bursts within a specified timeframe, say, up to ten microseconds. However, I'm currently unfamiliar with any other tool that provides a graphical representation similar to what Wireshark offers.

Your choice of tools depends on your specific role and responsibilities. If you're dealing with troubleshooting network, voice issues, or network operations, having a tool like Wireshark to dive into packet details is important. It lets you inspect what's happening at each header. On the other hand, if you're in a more administrative role, you may not need the solution.

I use the solution for port mirroring the SPAN ports to send the packet output out of a mirrored port I'm capturing. It helps me determine where the network communication is dropping. Six months ago, I used the tool with a Palo Alto firewall. We had a problem connecting to Azure ExpressRoute. We had to configure QinQ encapsulation. The solution helped us see that the configuration of the network equipment wasn't encapsulating QinQ. So, we knew what the problem was and what we needed to fix.

I like the feature that captures voice calls. It helps me see where the specific latency and jitters happen in the call. If there's a gap in audio, I can see the gap. If there's a digitization as a result of latency, I can see that. I love looking at the packet and seeing Expedited Forwarding or the DSCP tag.

The live capture and offline analysis have been helpful because I can see the real-time capture of the package coming in. The GUI is easy to use. I love that there's a portal feature and an install feature. We can look at multiple interfaces. We can set time frames for capture. I can only capture for ten minutes or only capture a certain amount of packets. I love the ability to see the color codes and change them. I can save the PCAP historical reference. 

I wish the filters were a little bit more prepopulated. It would have been easy to hit a drop-down and select a filter. If I only wanted to look at DCP, UDP, or IP, it would be easy to filter it out. Advanced network knowledge is required to get a lot out of the tool. However, it's very easy to install and deploy.

It would be nice if there were some handheld Android devices with a Wireshark-specialized application that would allow us to mirror a Cisco port. Then, we can just plug into the port and click the green start button, and it will start ingesting the packet capture. Then, we won’t be using a laptop.

The only downside is that we must have a laptop and connect a network cable. Some new laptops don't have network ports, so we have to get another adapter. Having an all-in-one device, like NetAlly or Fluke, and some of their network devices would be cool.

I have been using the solution for 12 years.

The tool has 100% stability. It never crashes.

I rate the tool’s scalability a six out of ten.

The ease of setup is relative to the individual's skill set, but I think the setup is relatively simple. The product does not require maintenance. It just has to be updated. It gets flagged on newer or high-trust security scans where organizations want to know that all third-party applications on the computers are up to date. If there are any vulnerabilities, Wireshark gets flagged. The update feature is a manual process. When we get prompts about an update, we run it. However, it can be automated with a tool like Ninite. I'm sure it can be automated with others as well.

The tool is free.

Wireshark is its own thing. It doesn't have a competitor that I know of. We can packet capture on firewalls, but I've never seen it on a switch. It's agnostic, and those are proprietary. The product is pretty well recommended in the IT community. Overall, I rate the solution a ten out of ten.

There were many use cases of Wireshark. When I was working in Genpact, we were handling more than 850 projects. Wireshark was a great help when we could not open any website or URL given by customers because it was getting blocked.

Wireshark plays a very important part in resolving day-to-day KRAs. Wireshark is a helpful tool for anyone working with a firewall or proxy. When we put up a scan for a particular destination, the product shows the sync at a very granular level. It shows whether the packet has been received or acknowledged by the end server or not. One of the best things about the product is that we can use it to track whether an issue occurred due to the website. Sometimes, the acknowledgment does not happen, and the end server does not accept the request. We get a granular bifurcation of the logs to see at what step it is dropping the connection. Wireshark helps us to understand network traffic.

The product has been using the same GUI for many years. The product must make its GUI more interactive and user-friendly. Any IT person working on the product would understand the information displayed on the product, but the GUI is not that familiar.

I was using the solution on a day-to-day basis until October 2022. I have used it for more than six years. In my current organization, the product is used very less.

The product is very, very stable. It can pass large amounts of logs. I have used the solution for three to four days continuously. It does not hang while reading the logs or giving the output.

The solution is scalable. I was the solution architect at Genpact. Only the L3 employees who were reporting to me had access to Wireshark. A few L3 employees from the firewall team also had access to the tool. Approximately 13 to 14 people were using the product in my organization based on the approvals they received.

We used the product because it is the first tool used by everyone in security or networks during their initial stages. Everyone knows about Wireshark, its uses, and how simple it is for IT personnel to use it. It is easy to download, easy to configure, easy to look up, and easy to do anything. We don't have to rely on someone else to teach us how the product works.

The initial setup is very easy. Wireshark is a restricted tool. We cannot simply install it on our machine in a large organization. It is one of the highly restricted tools which we use. Getting approvals in large organizations is a challenging task. Even if the organization approves the installation of the tool, they will approve it for only three to six months. We have to renew the approvals every six months to keep the tool installed on our machines. It was challenging because it's a sniffing tool. It is a blacklisted tool in every organization.

It is an open-source solution. The product is 100% free. Wireshark has launched some paid features which we never tried. Usually, the features we require are available in the open-source version. We completely depended on the free tool. It gave us perfect outputs.

We get all details about the product on the Internet. People with at least two to three years of experience in IT know Wireshark and its uses. It is not difficult for them to understand the tool. I would recommend the product to anyone who comes to me with any network or Internet issues where they cannot access a certain website or application. On an application level, the solution works fantastically. Though we can get logs for the website, it is not easy to track applications. It's one of the best tools in the market, which can help us resolve issues at the application, user, and end server levels. Overall, I rate the product ten out of ten.

I use Wireshark because it's an important tool for us as network engineers to find out the issue, whether it's network-related or application-related. Wireshark is a good tool for deep-dive analysis.

The feature to incorporate Voice over IP (VoIP) incidents into network traffic analysis is valuable. Capturing voice or SIP communication allows for examination of interactions between SIP clients and SIP servers. 

This helps the team investigate or analyze issues related to call center servers and operators. It's a tool for communication server functionality. These tools help the team achieve its objective of improving services by detecting issues.

You need some basic knowledge to work with Wireshark. Maybe it could be more user-friendly just for new users. Just for the new generation.

I use it every week. It is an important tool for our everyday operations.

I used Wireshark before the name change when it was Ethereal. That was the former name. Since around 2005 or 2006, I first used Ethereal, and then I got used to the name change to Wireshark.

Wireshark is fine. So far, I haven't encountered any bugs or issues. I would rate the stability a nine out of ten. 

I would rate the scalability a nine out of ten. It is fine for me. In our team, we have around five end users using this solution.

I've never contacted or needed any support from Wireshark. Everything I needed, I found in the documentation or on the web. There's a great community.

The initial setup is pretty simple and easy. Just download and install it. In some cases, admin privileges are required due to processes or features related to network systems. 

I've noticed that in some systems, you need admin privileges to use Wireshark. It's not an issue with Wireshark but a basic requirement for some systems.

Wireshark is open source and gives great value and functionality to the network investigation.

I've never checked or compared alternatives to Wireshark because this is the only thing I know. For me, there's no alternative to Wireshark. 

Wireshark is a foundation that many appliances today use the principle or functionality in their own product to provide the same objective. 

Wireshark is a premier tool in packet capture. I've never seen any alternative to Wireshark. Everybody in my environment knows Wireshark.

The GUI is okay. It's easy to use, but you still need some basic skills in ICT and IT networking and essential knowledge to interpret, as you should know some OSI layers, TCP/IP models, and have some basic knowledge in order to use Wireshark.

Overall, I would rate the solution a nine out of ten. 

I work on WiFi and I am a customer engineer. We use Wireshark to analyze the sniffer captures or tcpdumps. That's the purpose of the solution.

There are very handy filters available in Wireshark.

It’s free and doesn’t cost us anything to use.

The product is simple to implement.

It is a stable solution.

In my previous company, we had Omnipeek, and the UI was better than Wireshark. This product needs to improve the UI.

Generally, you can use Omnipeek to capture packets. You can also use Wireshark to capture packets. However, they need a compatible adapter. If we use Wireshark without a compatible adapter, we really don't go to capture packets using it. We already get captures from the field and from customers, and we just use it for analysis.

I would make maybe adding filters easy. There are some options that we can enable to look into the packet. For example, the default installation of Wireshark doesn't have much information. You can just get to see the packet number, the time's terms, the source address, the destination address, and some detailed information. If I want to see the RSSI, the channel number, the protocol information, or the data rate, I need to go and modify some of the configurations to add columns to display this information. I need to spend some time with it. Therefore, the Wireshark default installation could probably include some more crucial information. That would be a little helpful.

It's been a pretty long time since I started using the product. It’s been more than five years.

Wireshark in general is good. It is stable. We have used it on Windows. We have used it on Linux. We have used it on MacBook and it works pretty well on every platform.

The solution is scalable in the sense you can add it to however many laptops you need to. It's not like you have 500 people using the same Wireshark or using a common license. It is installed on everyone's PC and whoever wants to use it can. We are using the free version. Therefore, getting more people to put it on their PCs also doesn’t cost the company more.

In our company, about 150 people, or many a few more, are using the solution.

We’ve never had the need to reach out to technical support.

I used Omnipeek. The UI was better than Wireshark. However, it is quite expensive.

If somebody pays for Omnipeek that heavy price, they also prefer to get a compatible adapter or a compatible card that works with Omnipeek.

In this company, people just use the solution. However, there wasn’t a discount moment when management suggested it to everyone.

The initial setup was pretty easy. It was straightforward. We didn’t find it to be difficult.

It only takes a few minutes to get everything up and running.

The solution is free to use. We do not have to pay any licensing fees.

I’m a customer and end-user.

The solution is installed on my PC.

Wireshark is a pretty good tool if somebody wants to learn packet analysis or just plain, simple debugging of network issues at an L2 or L3 level. It is quite good for anybody, even a beginner. Anybody can use this tool and the installation is simple. The default installation should work quite well.

I’d rate the solution eight out of ten. If they could make the UI a little better and help us to get some more crucial information easily while providing some options to enable certain parameters based on the protocol, I’d give it a ten out of ten.

My work includes a feature that allows me to download traffic between different points, whether internal, external, or general. I use Wireshark to analyze this traffic. I also use it mostly for threat hunting.

I look at aspects like who is downloading the most data and who are the most active. I also check which country is generating the most traffic. It helps in analyzing if something looks suspicious, such as a brute force attack or scanning from somewhere. It assists in identifying source and destination and possible data extraction, which is helpful for incident response.

I have not used Wireshark to an advanced point where I could provide a detailed opinion on improvements needed. I find it to be a very useful tool beyond other traffic analysis tools.

I have been using Wireshark for more than five years now.

I have not faced any issues with stability.

Wireshark does everything I need.

I have never contacted their support team.

Positive

I was using Splunk about three months ago and tried to ingest some Wireshark captures.

I recommend Wireshark to other people.

I'd rate the solution eight out of ten.

I use Wireshark in my company for in-depth troubleshooting, especially when you need to look at individual packets.

The filter option provided by Wireshark is its most valuable feature. In Wireshark, you view packets based upon a set of rules that helps narrow down to find the packets you want to look at, making it probably the main feature of the product. Wireshark provides you with the ability to use an option called recompile.

Wireshark provides you with the ability to use an option called recompile. The tool also provides an RTP stream to its users. With Wireshark, the ability to play audio through the application is useful.

Wireshark could make the filtering rules easier to apply and offer a drag-and-drop option as opposed to type and text. The tool should also provide data prompts for some of the filters.

In the future, I want Wireshark to provide some visual representation of packet sizes, along with some graphical analysis tools.

I think you may have to download a separate interface driver when working with Wireshark, so I believe that the setup phase could be made simpler.

I have been using Wireshark for ten years.

Stability-wise, I rate the solution an eight out of ten.

Scalability-wise, I rate the solution a ten out of ten.

Around five people in my company use Wireshark.

Wireshark's initial setup phase is not bad.

The solution is deployed on a virtual machine.

I use Wireshark's free version.

I rate the overall tool an eight out of ten.

When we can see in the customer environment that traffic is getting blocked; suppose we have a VPN channel, and when the VPN channel is up but the traffic is not running through it, we use Wireshark to recapture the channel. We check whether the PPP handshake is ongoing or not. The acknowledgment team posts this packet, and after that, the PPP handshake is ongoing or not. 

So these are the things that we check by filtering out the things and based upon that, we get support. Because in five to six seconds, there are more than a thousand packets. So we have to filter out and check on which speed it is getting dropped. For that reason, we are using Wireshark. I am using it just for troubleshooting purposes.

Wireshark is pretty handy. It's especially useful for troubleshooting issues. However, the GUI interface is not that accurate. It can only show a limited amount of information, such as the source code, destination code, and services that are being blocked. If we want to know why a packet is being blocked by a particular policy, we need to check the packet capture.

We also use Wireshark to troubleshoot packet-level inspection issues, such as whether the payload is present, whether the packet size is too large for the receiver, and whether the DMTU (Dynamic Maximum Transmission Unit) is correct. We also use it to troubleshoot issues with fragmented packets.

In addition to the GUI, we also use the developer's tool and the command line to troubleshoot issues with Wireshark. For example, we use the cat and grep commands to filter out the information we need and to turn on debug mode. We also use the tail command to view the current history of logs.

I am currently working in a Linux environment, so I use the SysLog for configuration purposes on the Algo server. I use the TCP system command because Cisco uses port 514. So, I have to use the TCP system command to check whether we are receiving logs from the particular firewall or not.

Customers often tell us that they have open WDP 5144 traffic. They usually show us this in Splunk. For example, they might say, "We are forwarding the packet to the system, but we are not receiving the packet." This is usually because they need to test their end because they require some identity virus for the traffic to flow through our application.

Sometimes, the Algo server goes down, and we have to build it from scratch. Other times, the load distribution unit does not get synced with the primary. These are just some of the things we do on a daily basis with Wireshark.

While Wireshark is useful, the GUI interface is less accurate, showing only limited information.

I have been using Wireshark for three years. 

It is a stable product. I would rate the stability a ten out of ten. Every engineer in our organization uses this solution in our company. So, more than 22 users are using this solution. 

I would rate the scalability a nine out of ten. There is always room for improvement. 

It is easy to scale Wireshark. The GUI is very user-friendly. They have multiple videos online and on YouTube. Going through these resources provides a better understanding of Wireshark, its functionality, and how things operate within it. Essentially, it aligns with what we can learn from fundamental books or authoritative works.  

What we have analyzed on a theoretical basis, like the TCP handshake, SSL handshake, wireless controller handshake, SMTP handshake, and whatever we read in the books, we can technically see it in Wireshark each and every packet. For SSL, we can see multiple streams getting transmitted: server, client hello, client-server hello, then the client where Client Pre-shared. The client ciphers also send the TLS, TLS certificate SSL certificate. Then in the server, we can see the SSL certificate and the Cypress suite, which they want to negotiate on, and then their pre-master secret key, which is generated, and then the session keys are getting generated. So these are all the things that we read in our books; we can see it packet-wise, each and everything. The acknowledgment comes from their end, from the client or the server side. So we can see it is very much easy to use in Wireshark.

Gain practical knowledge of what we comprehend. Analogous to the basic mathematical concept of two plus two, this is a protocol-oriented understanding, similar to the alphabet in language. However, in the realm of networking, Wireshark proves highly beneficial. You can put into practice what you read in books by actively examining and validating it yourself.

Every engineer will always try to make things easy for the customer. S 

Positive

The initial setup depends upon the basics. You need to have a clear understanding of the basics. When you have a clear understanding, there's nothing more difficult for us.

We have deployed it both on the cloud and on-premises. We usually install agents from Google. Everyone cannot use it. At least we need to have a basic understanding of theoretical concepts. Once the theoretical concept is clear, then you can use the packet capture. So it is easy to do packet captures. You need to just check videos on YouTube.

Overall, I would rate the solution a nine out of ten. Just focus on the basics. Once they are clear, you can handle and master any of the products in the secure network market, whether it's switches, routers, firewalls, VPNs, load balancers, or whatever it is. Just focus on the basics of what you want to pursue in your career.

Wireshark is one of the best and most popular network management or monitoring tools. Whatever traffic is going from your Internet, you can use the solution to make a plugin into that. You can take a replica of that, and from layer one to layer seven, you can check how the packet is loading and what all information is included in that. Overall, Wireshark is the number one software in the industry that everyone uses for network management.

You can use Wireshark to see the traffic packet format, the IP layers, the fields, and the enabled flags. If you fetch those packets into the TShark version, cybersecurity employees can manipulate and use that packet. Wireshark is powerful to monitor the traffic and check the flags.

With Wireshark, you cannot download and utilize the packet in automation. Automation is right now expanding its own stuff. People are using some headless servers that do not need a GUI. So Wireshark will only be available if there is a GUI so you can see that packet clearly. So there is no transferring form of Wireshark right now available. You need to have some GUI on the server so you can check that via the check packet.

I have been using Wireshark for four to five years.

An open-source community channel is available where you can put your questionnaire or queries. If there is any issue or you're not getting packets correctly, you can always raise an issue on their community channel.

Positive

Wireshark's initial setup is very easy. You have to install the open-source software, and you'll get that package. Once you install it, then you can see the GUI, and you can connect. Whenever you connect any external LAN, you will be able to detect that software package from that virtual interface or the LAN interface.

Overall, I rate Wireshark an eight out of ten.