Wireshark
The reference graphical packet analyzer.
KaliParrotLinuxpassive
pkg: wireshark
Wireshark captures and dissects network traffic with deep protocol decoders and powerful display filters.
Syntax
wireshark (GUI; capture + display filters)
Example
wireshark -i eth0 -f "tcp port 80"
Captures on eth0 with a BPF capture filter limiting to TCP/80 traffic.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
wireshark
Usage examples
wireshark -i eth0 -f "tcp port 80"
Live capture filtered to HTTP.
wireshark -r cap.pcap -Y http.request
Open a pcap, filter to HTTP requests.
Advantages
- Unmatched protocol dissection
- Powerful filtering and follow-stream
- Huge format support
Disadvantages
- GUI is heavy for quick tasks
- Capturing needs privileges
- Large captures strain memory
Tags
#pcap#analysis
Official docs: Wireshark ↗
Related commands
Frequently asked questions
What is Wireshark used for?
Wireshark captures and dissects network traffic with deep protocol decoders and powerful display filters.
What is an example Wireshark command?
A common example is: wireshark -i eth0 -f "tcp port 80" — Captures on eth0 with a BPF capture filter limiting to TCP/80 traffic.
Is Wireshark part of Kali Linux?
Yes. Wireshark ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install wireshark.
What category of security tool is Wireshark?
Wireshark is a Sniffing & Spoofing tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.