Wireshark Reviews

Wireshark's main use case is capturing packets and reviewing the data flow over the network.

Regarding my main use case for Wireshark, it is a great tool and would be one of the best tools available if you work in networks and want to capture packets and see how data is moving and what protocols are working. You can also see the header and everything that is in the packet. You cannot see information that is encrypted, and that is a great thing because if you are looking into the network and want to see what communication is encrypted, Wireshark can show you that as well.

A specific example of when I used Wireshark to capture packets and review data flow involved a call that was not working from India to the US. I installed it on the client PC and reviewed the packet to check how the data was flowing and what issue we were experiencing. Wireshark can show you the RTP packets, which helps us significantly in reviewing and troubleshooting the issue.

My advice to others looking to use Wireshark is to use it only if you are completely sure that your system is not compromised.

The best features that Wireshark offers are everything. Every time I look into Wireshark, I find something new. The ability to capture real-time packets and understand how the packet is working and moving through how many hops and to how many points it reaches makes it a wonderful tool.

The specific feature I use most is capturing packets of real-time communication and seeing how the packet is working. I rely on all the filters it has to check the protocols and see the communication between one end and another end and what the hops in between are, and if there is a proxy, how it behaves. Everything helps us check out the issue and troubleshoot it.

I do not have anything additional to add about the features; everything looks really fine. The graphics are also good, and you can change its graphical features, making it a pretty nice tool. You can also use it with the PCAP file, which is really nice.

Wireshark has positively impacted my organization by giving us the ability to capture packets and see into the network how it is working and what we can clarify about the network, specifically how we can remove many hops in the communication channels.

A specific example of a measurable outcome is that we have a few switches in our network that, when we use Wireshark analysis, we find should not be needed or can be replaced with automatic switches instead of manual switches, such as switches which do not have any active features and only passive switches. That has saved us a lot of time.

Wireshark can be improved if it provides the accessibility of capturing packets from one device that is installed in the network without needing the port-mirrored facility. They could provide something that allows us not to set up port mirroring every single time if we want to capture data for a specific device.

I do not want to add more about the needed improvements; that is all that I need and what I see can be improved.

On a scale of one to ten, I would rate Wireshark a ten. The reason I give it a ten is that it is a great tool, and I do not think there is any tool better than this when it comes to capturing packets.

Regarding Wireshark's AI capabilities, I have not used them, so I cannot comment on that. I have not used the AI feature to assess accuracy and reliability of output, so I cannot provide any thoughts on that.

Wireshark is deployed in my organization as a tool; I have not deployed it over the network as we just use it as a tool whenever needed. It is installed in our system and on our jump servers.

There are no additional improvements needed for Wireshark that we have not discussed yet. I do not have any additional thoughts about Wireshark before we wrap up, as I have told you everything I can about it.

I would rate Wireshark a ten out of ten overall.

I'm using the solution for tasks like identifying top talkers and detecting network congestion. I specifically focus on understanding how the network behaves during short bursts, with sampling intervals ranging from milliseconds to tens or hundreds of milliseconds.

I also work with High Frequency Trading (HFT) and use the solution to address issues related to multicast and pinpoint and analyze any gaps in multicast packaging.

One of the features of Wireshark, which is incredibly valuable, is its ability to provide detailed and representative traffic analysis. It allows me to differentiate between protocols like DCP and UDP and even drill down to specifics, such as identifying potential issues caused by a particular destination IP. Additionally, the solution has proven to be a valuable tool for troubleshooting the issues I encounter since my primary focus is on data switching.

There is a disadvantage when it comes to sampling intervals. While the solution supports sampling as fine as one millisecond, it requires a copy at that interval. My Python script allows me to achieve a granularity of up to ten microseconds, but I can't go beyond that. When dealing with provisioning on both issues, it would be beneficial if I could go down to the microsecond level, if not the nanosecond. Additionally, I've heard from a colleague that Wireshark might be less effective in the voice domain.

I've been using the solution from the start of my career.

The stability of the solution is not great. It takes a hit when dealing with larger files, especially those exceeding the size of around 100 to 150 megabytes. It tends to crash and takes a considerable amount of time to recover—usually crashing after about five minutes. This poses a challenge, particularly when troubleshooting larger issues, as you then need to manually break down the file into smaller chunks for Wireshark to handle it smoothly.

The scalability of the product can be improved. In my team, over 50 of us are using the solution.

The initial setup is straightforward. Anyone starting out or looking to deploy it on your personal PC or machine can do it easily.

I've never personally had to pay for it, making it a highly valuable internet resource that's accessible for use. While they offer some paid versions, our firm has utilized the free version for the past three years.

I'm not aware of any packet capture tool besides Wireshark. As mentioned earlier, I've created my Python tool specifically for sampling. This tool allows me to load packet captures, identifying top talkers and bursts within a specified timeframe, say, up to ten microseconds. However, I'm currently unfamiliar with any other tool that provides a graphical representation similar to what Wireshark offers.

Your choice of tools depends on your specific role and responsibilities. If you're dealing with troubleshooting network, voice issues, or network operations, having a tool like Wireshark to dive into packet details is important. It lets you inspect what's happening at each header. On the other hand, if you're in a more administrative role, you may not need the solution.

I use the solution for port mirroring the SPAN ports to send the packet output out of a mirrored port I'm capturing. It helps me determine where the network communication is dropping. Six months ago, I used the tool with a Palo Alto firewall. We had a problem connecting to Azure ExpressRoute. We had to configure QinQ encapsulation. The solution helped us see that the configuration of the network equipment wasn't encapsulating QinQ. So, we knew what the problem was and what we needed to fix.

I like the feature that captures voice calls. It helps me see where the specific latency and jitters happen in the call. If there's a gap in audio, I can see the gap. If there's a digitization as a result of latency, I can see that. I love looking at the packet and seeing Expedited Forwarding or the DSCP tag.

The live capture and offline analysis have been helpful because I can see the real-time capture of the package coming in. The GUI is easy to use. I love that there's a portal feature and an install feature. We can look at multiple interfaces. We can set time frames for capture. I can only capture for ten minutes or only capture a certain amount of packets. I love the ability to see the color codes and change them. I can save the PCAP historical reference. 

I wish the filters were a little bit more prepopulated. It would have been easy to hit a drop-down and select a filter. If I only wanted to look at DCP, UDP, or IP, it would be easy to filter it out. Advanced network knowledge is required to get a lot out of the tool. However, it's very easy to install and deploy.

It would be nice if there were some handheld Android devices with a Wireshark-specialized application that would allow us to mirror a Cisco port. Then, we can just plug into the port and click the green start button, and it will start ingesting the packet capture. Then, we won’t be using a laptop.

The only downside is that we must have a laptop and connect a network cable. Some new laptops don't have network ports, so we have to get another adapter. Having an all-in-one device, like NetAlly or Fluke, and some of their network devices would be cool.

I have been using the solution for 12 years.

The tool has 100% stability. It never crashes.

I rate the tool’s scalability a six out of ten.

The ease of setup is relative to the individual's skill set, but I think the setup is relatively simple. The product does not require maintenance. It just has to be updated. It gets flagged on newer or high-trust security scans where organizations want to know that all third-party applications on the computers are up to date. If there are any vulnerabilities, Wireshark gets flagged. The update feature is a manual process. When we get prompts about an update, we run it. However, it can be automated with a tool like Ninite. I'm sure it can be automated with others as well.

The tool is free.

Wireshark is its own thing. It doesn't have a competitor that I know of. We can packet capture on firewalls, but I've never seen it on a switch. It's agnostic, and those are proprietary. The product is pretty well recommended in the IT community. Overall, I rate the solution a ten out of ten.

I use Wireshark because it's an important tool for us as network engineers to find out the issue, whether it's network-related or application-related. Wireshark is a good tool for deep-dive analysis.

The feature to incorporate Voice over IP (VoIP) incidents into network traffic analysis is valuable. Capturing voice or SIP communication allows for examination of interactions between SIP clients and SIP servers. 

This helps the team investigate or analyze issues related to call center servers and operators. It's a tool for communication server functionality. These tools help the team achieve its objective of improving services by detecting issues.

You need some basic knowledge to work with Wireshark. Maybe it could be more user-friendly just for new users. Just for the new generation.

I use it every week. It is an important tool for our everyday operations.

I used Wireshark before the name change when it was Ethereal. That was the former name. Since around 2005 or 2006, I first used Ethereal, and then I got used to the name change to Wireshark.

Wireshark is fine. So far, I haven't encountered any bugs or issues. I would rate the stability a nine out of ten. 

I would rate the scalability a nine out of ten. It is fine for me. In our team, we have around five end users using this solution.

I've never contacted or needed any support from Wireshark. Everything I needed, I found in the documentation or on the web. There's a great community.

The initial setup is pretty simple and easy. Just download and install it. In some cases, admin privileges are required due to processes or features related to network systems. 

I've noticed that in some systems, you need admin privileges to use Wireshark. It's not an issue with Wireshark but a basic requirement for some systems.

Wireshark is open source and gives great value and functionality to the network investigation.

I've never checked or compared alternatives to Wireshark because this is the only thing I know. For me, there's no alternative to Wireshark. 

Wireshark is a foundation that many appliances today use the principle or functionality in their own product to provide the same objective. 

Wireshark is a premier tool in packet capture. I've never seen any alternative to Wireshark. Everybody in my environment knows Wireshark.

The GUI is okay. It's easy to use, but you still need some basic skills in ICT and IT networking and essential knowledge to interpret, as you should know some OSI layers, TCP/IP models, and have some basic knowledge in order to use Wireshark.

Overall, I would rate the solution a nine out of ten. 

I use Wireshark in my company for in-depth troubleshooting, especially when you need to look at individual packets.

The filter option provided by Wireshark is its most valuable feature. In Wireshark, you view packets based upon a set of rules that helps narrow down to find the packets you want to look at, making it probably the main feature of the product. Wireshark provides you with the ability to use an option called recompile.

Wireshark provides you with the ability to use an option called recompile. The tool also provides an RTP stream to its users. With Wireshark, the ability to play audio through the application is useful.

Wireshark could make the filtering rules easier to apply and offer a drag-and-drop option as opposed to type and text. The tool should also provide data prompts for some of the filters.

In the future, I want Wireshark to provide some visual representation of packet sizes, along with some graphical analysis tools.

I think you may have to download a separate interface driver when working with Wireshark, so I believe that the setup phase could be made simpler.

I have been using Wireshark for ten years.

Stability-wise, I rate the solution an eight out of ten.

Scalability-wise, I rate the solution a ten out of ten.

Around five people in my company use Wireshark.

Wireshark's initial setup phase is not bad.

The solution is deployed on a virtual machine.

I use Wireshark's free version.

I rate the overall tool an eight out of ten.

There were many use cases of Wireshark. When I was working in Genpact, we were handling more than 850 projects. Wireshark was a great help when we could not open any website or URL given by customers because it was getting blocked.

Wireshark plays a very important part in resolving day-to-day KRAs. Wireshark is a helpful tool for anyone working with a firewall or proxy. When we put up a scan for a particular destination, the product shows the sync at a very granular level. It shows whether the packet has been received or acknowledged by the end server or not. One of the best things about the product is that we can use it to track whether an issue occurred due to the website. Sometimes, the acknowledgment does not happen, and the end server does not accept the request. We get a granular bifurcation of the logs to see at what step it is dropping the connection. Wireshark helps us to understand network traffic.

The product has been using the same GUI for many years. The product must make its GUI more interactive and user-friendly. Any IT person working on the product would understand the information displayed on the product, but the GUI is not that familiar.

I was using the solution on a day-to-day basis until October 2022. I have used it for more than six years. In my current organization, the product is used very less.

The product is very, very stable. It can pass large amounts of logs. I have used the solution for three to four days continuously. It does not hang while reading the logs or giving the output.

The solution is scalable. I was the solution architect at Genpact. Only the L3 employees who were reporting to me had access to Wireshark. A few L3 employees from the firewall team also had access to the tool. Approximately 13 to 14 people were using the product in my organization based on the approvals they received.

We used the product because it is the first tool used by everyone in security or networks during their initial stages. Everyone knows about Wireshark, its uses, and how simple it is for IT personnel to use it. It is easy to download, easy to configure, easy to look up, and easy to do anything. We don't have to rely on someone else to teach us how the product works.

The initial setup is very easy. Wireshark is a restricted tool. We cannot simply install it on our machine in a large organization. It is one of the highly restricted tools which we use. Getting approvals in large organizations is a challenging task. Even if the organization approves the installation of the tool, they will approve it for only three to six months. We have to renew the approvals every six months to keep the tool installed on our machines. It was challenging because it's a sniffing tool. It is a blacklisted tool in every organization.

It is an open-source solution. The product is 100% free. Wireshark has launched some paid features which we never tried. Usually, the features we require are available in the open-source version. We completely depended on the free tool. It gave us perfect outputs.

We get all details about the product on the Internet. People with at least two to three years of experience in IT know Wireshark and its uses. It is not difficult for them to understand the tool. I would recommend the product to anyone who comes to me with any network or Internet issues where they cannot access a certain website or application. On an application level, the solution works fantastically. Though we can get logs for the website, it is not easy to track applications. It's one of the best tools in the market, which can help us resolve issues at the application, user, and end server levels. Overall, I rate the product ten out of ten.

Wireshark is one of the best and most popular network management or monitoring tools. Whatever traffic is going from your Internet, you can use the solution to make a plugin into that. You can take a replica of that, and from layer one to layer seven, you can check how the packet is loading and what all information is included in that. Overall, Wireshark is the number one software in the industry that everyone uses for network management.

You can use Wireshark to see the traffic packet format, the IP layers, the fields, and the enabled flags. If you fetch those packets into the TShark version, cybersecurity employees can manipulate and use that packet. Wireshark is powerful to monitor the traffic and check the flags.

With Wireshark, you cannot download and utilize the packet in automation. Automation is right now expanding its own stuff. People are using some headless servers that do not need a GUI. So Wireshark will only be available if there is a GUI so you can see that packet clearly. So there is no transferring form of Wireshark right now available. You need to have some GUI on the server so you can check that via the check packet.

I have been using Wireshark for four to five years.

An open-source community channel is available where you can put your questionnaire or queries. If there is any issue or you're not getting packets correctly, you can always raise an issue on their community channel.

Positive

Wireshark's initial setup is very easy. You have to install the open-source software, and you'll get that package. Once you install it, then you can see the GUI, and you can connect. Whenever you connect any external LAN, you will be able to detect that software package from that virtual interface or the LAN interface.

Overall, I rate Wireshark an eight out of ten.

The primary purpose of Wireshark is to monitor network communications. For example, if we need to track our target in order to exploit it, or to understand our use cases, we can use Wireshark for both internal and external penetration testing. We can use Wireshark to capture communication from any IP, and if there is no encryption, we can also use it to retrieve client passwords. This is the main function of the solution.

Wireshark is very user-friendly; even someone with basic IT knowledge can use it. Wireshark has a large user interface and a good graphical user interface. Wireshark has all the features needed, such as sniffing the network, tracking packets, and sorting packets.

Previously, I have used Wireshark in some of the financial companies I have been involved with. For example, when I was employed at a bank, we used Wireshark. However, I have noticed that Wireshark is restricted when any sort of encryption is involved, such as XSL encryption or DLX. This means that Wireshark cannot be used to its full potential. Therefore, I think that Wireshark or the vendors should consider including features to penetrate firewalls and get the data, such as including any hash types.

I would like the ability to sniff user credentials, such as passwords, rather than clear text. Wireshark should be able to sniff basic encryption, such as 128 and 64-bit encryption, as other solutions do.

I have been using the solution for over ten years.

Wireshark is a stable solution.

I rarely need to contact technical support, as most issues can be resolved by looking at the Wireshark questions or FAQs. We can usually find solutions quickly.

Positive

The initial setup is very easy. We can send an executable file, we can just run the solution. Wireshark can be installed on a standalone workstation or if we want to create a server, we can also do that. The deployment takes around 30 minutes.

I give the solution a nine out of ten.

There is a purpose for using Wireshark. If we don't know the purpose or our agenda, then why are we using it? The solution would be useless for us in this case. If we are following an example and are a SOC person, we just need to sniff the communication and confirm that it is stable. However, if we are general IT people and do not know the purpose, then Wireshark would be useless.

Our primary use case of this solution is for wired or wireless sniffing.

I have found the most valuable feature you can design your sniffer the way you want to. As I said, by default it will have all the legacy features or legacy or advanced features. So apart from that in your device, if you have a particular feature that is enabled, then you can modify it by changing the source code. It provides you with the source code. It is an open source so you can get a source code, you just need to create a plugin or API and point it to that source and you compile it.

In the future, it would be nice to see color coding. It is just black and white. 

I have been using Wireshark for the past fifteen years.

The stability is excellent and reflected in the automation integration.

If you are a good programmer everything is available online. There is a community-based option to ask questions and you will get answers.

The initial setup is straightforward. You type in Google or Bing Wireshark download. Then you will be taken to the Wireshark webpage and there is a tab called download. Download the latest stable version that is available. It is an EXE file or an MSF file.

For the initial stages, I prefer Wireshark but after six months to a year, I like to use OmniPeek. Wireshark is very easy to use and I would rate it an eight out of ten.

We're using an internal Wi-Fi card in the laptop, so we configure that particular wireless interface into monitoring mode, configure the channel, and use Wireshark for that specific interface. We can capture the packets and activities on that channel, analyze the packets for poor connections, etc.

What's best about Wireshark is that it doesn't require installation. It supports cards and monitoring permissions and is sufficient for appending and capturing activities. You won't need to install other tools to use Wireshark, so this saves you time. You can capture packets at any time from your laptop through Wireshark.

Wireshark is similar to an OS defense tool, meaning that it runs on an OS such as Ubuntu and Fedora, but I'm unsure if it's compatible with Windows or if it's a straightforward process to run it on Windows. Right now, my team needs to run Wireshark from a dongle to use it, so it's an OS-dependable tool, and that's an area for improvement.

I was unable to use Wireshark on Windows, and I couldn't capture it, as I'm unsure how to configure the wireless card into monitoring mode on Windows. The process was straightforward on Linux, but it wasn't the case on Windows OS. It seems Wireshark isn't compatible with all OS. For example, you can analyze the log, and you can analyze it on the Windows server, but you can't do a capture in Windows. Configuring Wireshark for Windows isn't as easy as configuring it for Linux.

What I'd like to see in the next release of Wireshark is the capability to capture packets from the ethernet.

I started using Wireshark six or seven years ago.

Wireshark is a stable product.

Wireshark is a scalable product.

I never needed to contact technical support for Wireshark.

My company uses Wireshark and has not tried a different solution. The biggest factor on why it decided to use Wireshark is because it's open-source software that doesn't require installation and a license, so anyone can use it.

Wireshark is pretty easy to set up. Its deployment doesn't take much time. It only takes ten to twenty minutes max to complete Wireshark deployment.

Wireshark is an open-source product, so it's free to use.

All people within my company use Wireshark, so that's two hundred users.

My advice to anyone looking into using Wireshark is that you should know how to configure the interface and the internal Wi-Fi card into monitoring mode, so you can capture via Wireshark. As Wireshark is a good tool, I'd recommend it to others, but you should have some knowledge of how to use it and how to configure it. Before implementing Wireshark, you need to know your objectives, working scenarios, what type of features you'd want to implement, and what changes you need to make.

I'd rate Wireshark eight out of ten because for you to configure and use it requires proper knowledge. It's straightforward to use if you have some knowledge of configuring it for monitoring.

I'm a customer of Wireshark.