Wireshark Reviews and Pricing

it_user260115

Senior Network Engineer at a tech services company with 501-1,000 employees

Feb 5, 2018

Download

Drill-down for packet analysis is great, gives insight into what is going on at packet level

Pros and Cons

"The drill-down available for packet analysis is great. It gives a network security engineer insight into what is going on at the packet level and enables better troubleshooting."

"The Wireshark search function shows green for a correct search and red for an incorrect search. If there were a way to provide a description about what a search - and the similar ones which are available - can do, while a person is typing it, it would make the product easier to use and simultaneously decrease the learning curve."

How has it helped my organization?

The people to whom I have introduced this product have found it a great tool to analyze packets. Instead of troubleshooting by trial and error, they have a way to investigate, verify, and then apply a solution. Of course, to derive value from the product, you must know its features.

What is most valuable?

The drill-down available for packet analysis is great. It gives a network security engineer insight into what is going on at the packet level and enables better troubleshooting.

What needs improvement?

The Wireshark search function shows green for a correct search and red for an incorrect search. If there were a way to provide a description about what a search - and the similar ones which are available - can do, while a person is typing it, it would make the product easier to use and simultaneously decrease the learning curve.

For how long have I used the solution?

Three to five years.

Buyer's Guide

Wireshark

June 2025

Free Report: Wireshark Reviews and More

Learn what your peers think about Wireshark. Get advice and tips from experienced pros sharing their opinions. Updated: June 2025.

DOWNLOAD NOW

860,592 professionals have used our research since 2012.

What do I think about the stability of the solution?

No stability issues.

What do I think about the scalability of the solution?

No scalability issues.

How are customer service and support?

I have not used technical support.

Which solution did I use previously and why did I switch?

I used Microsoft's Network Monitor, but with due respect to Microsoft, I prefer Wireshark.

How was the initial setup?

Straightforward.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

it_user393891

ArcSight Engineer at a tech vendor with 51-200 employees

Feb 5, 2018

Download

Parses large packet capture files without opening them, returns relevant information

Pros and Cons

"Packet-capture files can be hard to use due to their size. Wireshark has a tool called tshark that can parse the files with out opening them so that you can take large captures, say 2-10GB, and return only relevant information."

"The product is great but I wish there were more of an emphasis on the command line tools."

What is our primary use case?

It is utilized for forensic work, with full packet capture.

What is most valuable?

Packet analysis and filtering. Packet-capture files can be hard to use due to their size. Wireshark has a tool called tshark that can parse the files without opening them so that you can take large captures, say 2-10GB, and return only relevant information.

What needs improvement?

The UI redesign threw me for a loop but I have learned to overcome it. The product is great but I wish there were more of an emphasis on the command line tools.

For how long have I used the solution?

Three to five years.

What do I think about the stability of the solution?

No stability issues.

What do I think about the scalability of the solution?

No scalability issues.

How was the initial setup?

Just install the software and the WinPcap software.

What's my experience with pricing, setup cost, and licensing?

It's a standalone tool. If there is a commercial license for it I am unaware of it.

What other advice do I have?

Make sure you are comfortable installing the WinPcap driver for packet collection. This tool could be used maliciously to capture data on your network.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

Buyer's Guide

Wireshark

June 2025

Free Report: Wireshark Reviews and More

Learn what your peers think about Wireshark. Get advice and tips from experienced pros sharing their opinions. Updated: June 2025.

DOWNLOAD NOW

860,592 professionals have used our research since 2012.

it_user133842

Infrastructure Connectivity Engineer at Reputable Service Company

Sep 16, 2015

Download

Regardless of network size, it provides intelligence about any type of data packets, especially during a security attack, although buffer size of captured data should be unlimited and archived.

Valuable Features:

Some valuable features of Wireshark are deep packet inspections based on the capturing process with it's sniffing capabilities.

Improvements to My Organization:

In order to be more intelligent about all the bits/frames/packets/data traversing your network regardless of how small or large the network is, Wireshark is a network analytic tool which provides such an intelligent information in a network.

Wireshark is that intelligent, not only for production environment alone but also aids study about the packet fields that may exist in any type of packet header of data flowing in your network.To view how all the classes of QoS marking in a packet are and can be used to also sniff packets during reconnaissance phase of a network security attack.

Wireshark provides better understanding on how the bits are set for different fields in a packet header.

It is indeed a very good tool which all network administrators need to be familiar with.

Room for Improvement:

Maximum buffer size of captured data should be unlimited and should allow ability to archive all old captures (not save option) in real time, it should support a destination location where old captures can be directed for long term storage.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

it_user148368

Senior Manager of Engineering at a tech vendor with 1,001-5,000 employees

Sep 21, 2014

Download

A good open source & free packet analyzer. Versatile tool that helps enigneers analyze & troubleshooot networks issues.

What is most valuable?

The packet details pane.

How has it helped my organization?

Use daily for packet analysis.

What needs improvement?

Bigger memory footprint.

For how long have I used the solution?

7 years.

What was my experience with deployment of the solution?

What do I think about the stability of the solution?

I blame the PC OS.

What do I think about the scalability of the solution?

How are customer service and technical support?

Open source so feedback to forum.

Which solution did I use previously and why did I switch?

Nope.

How was the initial setup?

Yes.

What's my experience with pricing, setup cost, and licensing?

Free.

Which other solutions did I evaluate?

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

Henry-Steinhauer

Systems Engineer at LifePoint Health

Jun 19, 2014

Download

Best general purpose tool for trouble shooting anything on the network.

Valuable Features:

-One of the best products that can provide the details of what is happening with an application and the full life cycle of the response time. - Using Multiple trace files can allow you to create really big trace samples. Thus not a problem to let it run for awhile to gather that hard to catch 'problem'

Room for Improvement:

Not always simple to setup and get the filtering right when capturing data. The TCPDUMP pre filter is a bit hard to get use to when you are used to using the post filter. It will help when they have the same filter for both. Of course I'm assuming that the Post filter will be the filter of choice and translate the Post Filter into what needs to be done for the Pre Filter. I use the export to CSV and also the Print Full trace to a file features to do post analysis that would otherwise be impossible to do any other way than using WireShark. An example is watching MQ Traffic through a MQ Broker. Using the MQ Token, I'm able to combine the send / receive responses together to see the final response time and also where the packets are sent/received. This has helped with the SOA analysis when you have traffic going to a MQ Broker to be sent to other servers for responses. 4 packet sets are involved when this is done. 1 Request in to the Broker, 1 Response out from the Broker to a Responder, then a response from the Responder to the Broker again, and the final response from the Broker back to the original Requestor. All of that chatter needs to be captured and seen for the full response time analysis. Using the Packet Print, I'm able to dig into the header of the MQ packet and find that information for post assembly of information into a CSV file. Using Perl, I'm able to read these files in automation and create CSV files for use in Excel to then provide the packet numbers to use again in the Post Filter process of WireShark to look at further details. This is complex, but so are the actual interactions that are taking place. This work would be impossible with out a tool like Wireshark that provides the insight and decoding of the MQ headers of the packets. This brings out the Tokens and response Tokens of the packets for analysis. The other SOA and complex Websphere interaction tools are getting better at presenting this information, but there are still times where the developors have created something that the other tools have not tackled yet. Then WireShark is the only way to really drill into those interactions.

Other Advice:

Wireshark continues to be updated and is still an alive application. Continue to explore this product.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

it_user4401Developer at a transportation company with 1,001-5,000 employees

Report as inappropriate

Apr 20, 2013

Wireshark excels in the number of protocols that it supports, over 850. Also, the Wireshark interface is one of the easiest to understand of any packet sniffing application. I would like to mention that it is free, so it's pricing can't be beat. Wireshark supports all major modern operating systems, including Windows, Mac OS and Linux-based platforms.

it_user3420

Owner with 51-200 employees

May 1, 2014

Download

The best thing about Wireshark is the community/ecosystem....

Valuable Features:

The best thing about Wireshark is the community/ecosystem. Answers are easy to find in either the documentation or on the wiki. Packet analysis is not for the weak at heart, but Wireshark makes it as painless as possible with profiles, extensive decodes (dissectors), expert system and filtering capability. I use it everyday.Best features to get started with: Network Monitoring with Statistics>Endpoints - Who is talking? Network Monitoring with Statistics>Conversations - Who is talking to who? Application Monitoring with Statistics>Service Response Time - How fast did they get an Application layer response? Visualization with Statistics>IO Graph - Can I see it all in a pretty picture?

Room for Improvement:

It is easy to get overwhelmed with the amount of data you are looking at. But that is true with any analysis tool. The best approach is to focus on a single process that interests you, follow its stream and walk through the packets until you understand what is happening. Then move on to learn the next thing. How do you eat an elephant? One "byte" at a time.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

it_user113184Security Expert at a tech services company

Report as inappropriate

May 15, 2014

What about using a solution that would allow you to find trouble fast and apply effective vision and clarity to resolve the issue? thx.

it_user68601

Network Engineer at a tech services company with 51-200 employees

Nov 18, 2013

My Favorite Wireshark Filters

Wireshark is hands down one of the best analysis tools on the planet. It is intuitive, simple to use, and gives the depth needed to find problems in today's network and application environments. Sometimes it can be tough to remember some of the filtering commands though, so here is a list of some of my favorites:

1. !(ip.addr==10.0.0.1) [displays everything except IP traffic to or from 10.0.0.1]

2. ip.addr==10.0.0.1 && ip.addr==10.0.0.2 [sets a conversation filter between the two defined IP addresses]

3. http or dns [sets a filter to display all http and dns]

4. tcp.port==4000 [sets a filter for any TCP packet with 4000 as a source or dest port]

5. tcp.flags.reset==1 [displays all TCP resets]

6. http.request [displays all HTTP GET requests]

7. tcp contains traffic [displays all TCP packets that contain the word ‘traffic’. Excellent when searching on a specific string or user ID]

8. !(arp or icmp or dns) [masks out arp, icmp, dns, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest]

9. udp contains 2069999999 [sets a filter for the number string, great when trying to locate a specific caller ID in a VoIP capture]

10. tcp.analysis.retransmission [displays all retransmissions in the trace. Helps when tracking down slow application performance and packet loss]

Disclosure: My company does not have a business relationship with this vendor other than being a customer.

it_user133842Infrastructure Connectivity Engineer at Reputable Service Company

Report as inappropriate

Sep 16, 2015

Wireshark is that intelligent, not only for production environment alone but also aids study about the packet fields that may exist in any type of packet header of data flowing in your network. to view how all the classes of QoS marking in a packet are and can be used to also sniff packets during reconnaissance phase of a network security attack.

Wireshark provides better understanding on how the bits are set for different fields in a packet header.

It is indeed a very good tool which all network administrators need to be familiar with.

it_user3114

Network Engineer with 51-200 employees

May 13, 2013

Troubleshooting IIS Connection Issues

I really get excited when I am able to reproduce problems in the lab.

With this specific case, the customer was experiencing errors within their web browsers that looked like either a network or server issue. The specific symptom was that certain images would not display. If you waited a while, and ‘refreshed’ the page, more of it loaded or the entire page loaded properly.

I’m sure you can imagine the chaos this type of intermittent problem causes. The sequence of events unfolds in the following manner; the client reports the webpage issue to the help desk and the help desk tests the webpage with mixed results. In either event, the problem goes to the server group who tests and finds nothing wrong, and then the problem goes to the network group which, in most cases, does not see the problem. Then the political fist fights, finger pointing and witch hunt commence…..

In this case, they even managed to capture some packets during the problem and saw a HTTP “Service Unavailable” message and were having issues interpreting exactly what that would mean. I was there doing some other work when they dumped, uh, I mean asked me if I could help.

They explained that when the problem was occurring, the network management system was not reporting that the server or application was down. I asked how they knew that and they said that they pinged the server, tested for tcp port 80 and lastly retrieved the html page. Wow, I was impressed. I don’t see too many people monitoring from the IP layer up to the Application layer.

I then told them that even though this was an excellent way of monitoring, I wasn’t too surprised that no outages were recorded. If it was an application issue, the pings will still work as well the TCP port check. If all you did was retrieve a single html file, it would not use the same number of connections as actually loading a page and rendering images, etc…

That’s when the lab work came in. I went to my lab and configured IIS to only accept 1 connection, created a simple html file which had a few images on it. After the first try I saw the exact same issue the client experienced as well as the same HTTP message in the analyzer. AWESOME!!!

In the video below you will see how I did it and the results.

Enjoy
http://www.youtube.com/watch?v=-xVqKe53t5s

Disclosure: My company does not have a business relationship with this vendor other than being a customer.