Wireshark

Overview

Wireshark is the dominant packet analyzer. It decodes 3000+ protocols and is the reference for anything from "why is this API slow?" to "extract the exfiltrated ZIP from this PCAP." tshark is the CLI companion — use it in scripts, over SSH, or when the capture is too large for the GUI. Capture filters (BPF) trim traffic at capture time; display filters refine what you see afterward. The current stable series is 4.6 (4.6.9); distributions still ship 4.4, and every command here works on both.

Instructions

Install and Allow Capture Without Root

sudo apt install tshark            # Debian/Ubuntu: CLI only; `wireshark` adds the GUI
brew install wireshark             # macOS: CLI tools; GUI: brew install --cask wireshark-app
winget install WiresharkFoundation.Wireshark   # Windows; live capture also needs Npcap (npcap.com),
                                               # which the silent install skips