Problem solve Get help with specific problems with your technologies, process and projects.

Wireshark, reincarnation of Ethereal, sniffs wide variety of networks

The network capture utility once called Ethereal now goes by the name Wireshark. It's been released as a free product under the GNU General Public License, has been ported to 32-bit Windows (and Vista), and reads live data from many types of networks.

Once upon a time, there was a network-capture utility named Ethereal, and it was good. Unfortunately, the original author of Ethereal, Gerald Combs, had to change the name of the product when he took a position with network monitoring tool vendor CACE Technologies, which published a competing product.

Ethereal has now been reincarnated as Wireshark. The same team of engineers works on the product. However, Wireshark has been released as a free product under the GNU General Public License. It's free for most uses (i.e., deployment in a corporate environment or personal use) but it cannot be re-used as part of a commercial product without adhering to certain rules regarding incorporating GPL-covered software in a proprietary system.

CACE has ported Wireshark to a variety of platforms, including 32-bit Windows (including Vista), Linux, Solaris and Mac OS X.

For those who are not familiar with Ethereal, Wireshark reads live data from many types of networks—not just Ethernet, 802.11 wireless or token-ring, but also FDDI, PPP/SLIP serial links and ATM connections. The results can then be dumped out to a file and analyzed, either live or from a previous dump file.

With Wireshark, it's always possible to add support for other protocols in the future. Furthermore, Wireshark can read a wide variety of capture file formats—everything from the output of standard tools like libpcap and tcpdump to proprietary formats such as the dump output from Toshiba ISDN routers. (Dump files can also be exported as plaintext, PostScript, CSV, markup or raw byte dumps.)

Features in Wireshark make the task of capturing and analyzing traffic as easy as possible. One such function is the ability to "follow" TCP streams, which lets a network administrator view traffic for a particular TCP conversation as a given application would see it. Also included in Wireshark is an interpreter for Lua, a language that allows admins to write scripts and other automation features for the program. The product's documentation includes samples to get you going, as well as a full rundown of the APIs exposed in Wireshark.

About the author: Serdar Yegulalp is editor of the Windows Insight, (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of Windows experience under his belt, and contributes regularly to and

More information on this topic:


Dig Deeper on Windows systems and network management

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.