Wireshark

Wireshark is a network protocol analyzer that has become a standard across several industries. Supported protocols are still growing, the number going by the hundreds. It can do live captures and offline analysis, VoIP analysis, and protocol decryption.

It is among the most popular network protocol analyzers. Firstly, it’s easy to use and has an intuitive interface.

But secondly, and perhaps more importantly, it has some nice features and functions you won’t find in other apps. It will feature support for hundreds of protocols and file formats to help you analyze protocols.

Capture Data and Files

With Wireshark, you can read and write files in different formats. You can also output exports in XML formats if you want to share them. You’ll be able to get data from a wide variety of protocols. Currently, there are more than 600 protocol types that you can dissect and manage.

You will capture data off the wire from a live network and read from a saved file, and you can also browse for data from the GUI.

You can also read live data from Ethernet, FDDI, PPP, Token-Ring, IEE 802.11, and other interfaces, such as loopback interfaces.

Edit Files and Data

What is more, you can also edit and configure the captured data and files. You can do so with the editcap function via command-line switches. You can then output the data you have from the application and export it via XML.

You may also save them for later use or even print them as plain text or PostScript.

With the filters inside the app, you’ll filter what data you see and view. You can use these filters to highlight and color packet summaries and select the information you want to see. And you can also save the network traces to the disk if you wish to.

Conclusion

Wireshark is a popular network protocol analyzer that will offer you some neat tools for reading and saving data you get from the reports inside the tool.

• Data can be captured "off the wire" from a live network connection or read from a capture file
• Live data can be read from Ethernet, FDDI, PPP, Token-Ring, IEEE 802.11, Classical IP over ATM, and loopback interfaces (at least on some platforms; not all of those types are supported on all platforms)
• Captured network data can be browsed via a GUI or the TTY-mode "tethereal" program
• Capture files can be programmatically edited or converted via command-line switches to the "editcap" program
• 602 protocols can currently be dissected
• Output can be saved or printed as plain text or PostScript
• Data display can be refined using a display filter
• Display filters can also be used to highlight and color packet summary information selectively
• All or part of each captured network trace can be saved to disk