Wireshark Reviews

Wireshark is a packet analysis tool. We check Wireshark when we don't know what's causing an issue.  The network packets never lie. Three people on my company's network team use Wireshark. 

It's an efficient solution for determining unexplained issues. It helps us rule out the network as the cause of an issue. When people don't know the reason for a problem, they always believe it's the network. Wireshark enables us to prove ourselves to the other teams. 

Wireshark is a simple solution. 

Wireshark doesn't have a dashboard. 

We have been using Wireshark for around 10 years.

Wireshark is stable. 

Wireshark is scalable.

Setting up Wireshark is easy and usually takes about 10 to 15 minutes. 

Wireshark is open source, but you can pay for support. 

I rate Wireshark seven out of 10. If you use the free version, you can't get technical support, but it's cost-effective. When you first use Wireshark, it can seem complex, but it's an effective solution once you get used to it. Packet analysis is complicated, but it's the best way to do the job once you understand the solution.

I mainly use Wireshark to look at traffic conditions when something is getting stopped in our network.

The most valuable feature is the traffic gate, which shows which IPs are getting more bandwidth or traffic.

Wireshark could be improved by adding more monitoring features.

I've been working with Wireshark since 2008.

Wireshark is stable.

The initial setup was very simple.

Wireshark is the best packet capturing tool, and I would rate it eight out of ten.

There are multiple use cases for Wireshark. One of the primary use cases is capturing the customer's network traffic. When an issue occurs on the customer's network, we take packet captures to analyze and decode the streams that were active during the time of the incident. 

Additionally, we use Wireshark to replay packet streams. This helps us troubleshoot issues that may not be readily observable on the live network. With the packet capture in hand, we can analyze the decoded packets and identify the protocols involved and the specific nature of the issue that occurred.

The best part about Wireshark, in my opinion, is its ability to analyze packet capture files. It lists out various protocols like TCP, UDP, or SCTP, along with source and destination codes. This feature is truly amazing.

One thing that I feel is currently missing in Wireshark is the ability to perform deep analytics on traffic streams after they have been decoded. While it may not be the major use case right now, it would be beneficial to have some sort of leveraging of artificial intelligence or machine learning to automatically detect threats or vulnerabilities based on specific types of network traffic. Predictive analysis of this nature is currently absent in Wireshark.

So in future releases, it would be great to see more robust analytics for traffic streams in the next version of Wireshark.

One improvement I would suggest is having more graphical representations of network topologies in Wireshark. Currently, when we deploy Wireshark to collect streams, we lack visibility into how different entities are connected at that specific time. Having a network topology view of connected devices, showing the source and destination, would be really beneficial. For example, in DNS troubleshooting, visualizing the network path can help recreate certain issues. Unfortunately, this feature is not currently available in Wireshark.

I've been working with Wireshark for more than 12 years. I would consider myself a network software development professional with extensive experience.

I've worked with major companies like Cisco Systems and other networking companies.

I would rate the stability of Wireshark as nine out of ten. It's quite stable.

In terms of scalability, I would rate the scalability a seven out of ten. It is difficult to scale this solution. 

The use cases I've worked on require deploying Wireshark independently on each node. However, if I want to deploy Wireshark on hundreds of devices and collect information at a single location for better network management, that capability is currently not available. We need Wireshark to run on all the devices and have one device act as a controller to collect and process the information.

Wireshark is popular among both individual users and enterprise organizations, but currently, it is mostly used individually for debugging network traffic.

I usually troubleshoot issues on my own. However, since Wireshark is open source, there is a community support system available.

Deployment-wise, Wireshark is relatively simple. It's not overly complex, and it works quite well. So, in that respect, it's a good solution.

We are working with a hybrid model. We deploy Wireshark in both cloud platforms and on-premises. Depending on the real devices and entities, we sometimes deploy it onto virtual machines in the cloud and collect and process information using a switch. This flexible deployment approach allows us to cater to different scenarios and adapt accordingly.

I can compare Wireshark with tools like Suricata and Zeek. Suricata and Zeek are both implemented considering setting objectives, meaning that they are designed to achieve specific goals. For example, Suricata is designed to decode packet streams, perform analysis, and push configuration changes to devices. This makes it a good choice for an Intrusion Prevention System (IPS), which is a system that can detect and prevent attacks.

Wireshark is the base of Suricata. Suricata both use the same packet filter implementation, known as BPF (Berkley Packet Filter). BPF is a powerful tool that can be used to capture and analyze network traffic.

In general, I'm quite fond of Wireshark, so I would rate it an eight out of ten.

Our primary use case for the solution is to see the over-the-air packets, the data transmission, and the wifi connection.

The transmission and reception issues are valuable. For example, while debugging through food issues, we can draw the graph of the data captured in the solution and see how the throughput is moving.

The solution can be improved by increasing its capacity to manage larger files. Wireshark gets stuck when it is a larger file.

We have been using the solution for approximately eight years.

The solution is stable.

The solution is scalable.

We have not had experience with customer service and support.

The initial setup is straightforward. 

I rate the solution a nine out of ten. The solution is good, but the solution can be improved by increasing its capacity to manage larger files. I advise users considering the solution to have the latest PC to load it. The newest voice is also required to load it otherwise it is difficult to open.

We primarily use the solution for reading packet captures. It's like a packet analyzer, packet capture. 

I'm just reading some packets and looking for interesting tracking. That's all.

The solution is open-source. 

It does have SolarWinds in it or is involved in SolarWinds in some way.

The search filtering is very good. 

It has good basic features. 

There's a lot of information available online. Even if I am looking for something special, I can find details about that aspect. 

It is well structured.

The initial setup is very easy.

I find the product to be quite stable. 

We can scale the solution. 

It works pretty well, and we haven't seen any areas that are lacking. 

We'd like to be able to extract the output into an Excel table.

I've used the solution for a couple of years. 

The solution performs well. It's stable. We haven't had issues with bugs or glitches. It doesn't crash or freeze. 

In the beginning, maybe seven or eight years ago, we did have some issues. However, that was a long time ago, and that was resolved. 

It's my understanding that the solution can scale. 

You can pay for a version that offers a support tier. However, I am using the basic, free, open-source version. There is no support tier. If you need information in relation to troubleshooting, everything you need is online. You can search the internet and find what you need. 

The solution is very simple and straightforward. It's pretty easy. I wouldn't classify it as complex or difficult. 

I'd rate it five out of five in terms of ease of setup.

The solution is open-source and free to use. That said, there is a paid tier with more features if a company needs a bit more. 

I'm a customer and end-user. 

I'd recommend the solution to others. It's a good product. 

I'd rate the solution ten out of ten. 

Wireshark can be used to troubleshoot network issues, but also to baseline applications. When you know what an app does when there is no issue at hand, you will be better able to spot the problem when there is an issue. Everything that happens on the network can be analysed with Wireshark. However, the tool is as good as the person using it. You need TCP/IP knowledge to be able to use a tool like this. The more you know about packets on the wire, the better you can use this tool.

It gives us the ability to pinpoint problems and to communicate network problems with software and hardware vendors. The packets never lie!

Making different profiles to tune the tool for the problems at hand, the graphing options, to customize the screen layout, etc.

Also, shines for wireless troubleshooting, but most hardware does not give full insight in WiFi communication (beacon frames, etc.).

Big trace files (more than 1,000,000 packets) can be slow, but then you can use "TraceWrangler" (also free) to help with slicing and dicing the data.

This is no complaint, but is not an easy program. You will need to study to use it to its full capabilities (follow a course), but the more you know about it, the more you will use it.

No issues.

Big trace files need to be chopped for analysis.

My bug reports were in the next release, therefore a great experience.

I have used it more or less since 2001. So no, I did not use a previous solution.

Download, run setup, enter;enter;enter..., it is ready.

In-house.

It is free to download and install. It runs on multiple platforms, so how can you go wrong?

In those days, there was a tool "Sniffer", but it was too expensive.

If you profile yourself as a network specialist, and don't use it, I would not trust you on my network.

It is even referenced in the book "TCP/IP Illustrated, Vol. 1", the TCP/IP bible!

I use it for network investigation, I even have a patent for the simplification of Protocol Analysis. I have used Wireshark many times to troubleshoot network situations and problems. The patent solved the problem of troubleshooting where you needed to know the direction and course a packet takes in the network which helps with the ability to know where problems lie in the network. We developed the system to actually troubleshoot an entire network through the use of network probes, which acted as smaller protocol analyzers.

It helped in the sense that it allowed the team to troubleshoot networks faster. While I worked at Verizon, our group was able to provide network analysis of our testbed which gave us an advantage over most test groups. This was because we could follow a packet throughout the network to examine the treatment that the packet was receiving in the network. The improvement came when we realized that through the use of this method we could duplicate the results of using a much more expensive version of our program called RMON.

I use the filters very often, to determine what type of traffic I am looking for. The use of filter allows traffic to be segmented so that a value can be looked at individually apart from the other traffic. I remember one day when we had to find out what was causing one of the systems to crash. We used our system to look at the network as a whole and we found that the device actually gave us the ability to segment the network finding the problem is a faster way which allowed for a more accurate test of the network.

The system could be improved upon by adding a better and more powerful data processing engine. The original was based on the Raspberry Pi. The RPi unit acted as a sensor on the network relaying information back to a centralized computer which was able to correlate and provide analysis as to the packets and their reaction to traffic loads. Much improvement could have been done but we were not that lucky. The more we designed items the more we began to realize that we were getting too far from our central goal of trying to make the network better.

I have been using it since it was called Ethereal.

I am impressed with the stability. 

Great scalability, but they are beginning to sacrifice ease of use for complexity. That was why we needed to simplify things.

No, we did not use another solution like wire-shark, but what we used in the past was the RADco. The RADcon was a protocol analyzer that was an all in one unit that was the standard at the time but did not allow for cooperative testing.

If you can get the same use for less cost do it.

No, we did not.

I used it for a couple of school projects last semester. We basically had to emulate how to capture packets in transit in a network. After capturing those packets, we analyzed them. We also had to break down email messages and dig out pictures inside email messages.

It was deployed through a cloud. They had set up a subscription for a class VM.

Being able to dissect email data and figure out what is inside email messages was the most valuable feature. Such a feature is pretty helpful for an ongoing forensic investigation or when there is a potential insider threat that you are trying to investigate. It allows you to see the network activity of the users you are investigating. It also gives you more visibility into your network.

It was very easy to set up. There is a lot of information out there on Google and YouTube about how to use it. There is also community support. If you have any trouble, it is pretty easy to find an answer online. You will have to do some digging only if you have a very specific use case.

Its user interface was a little less friendly. They can make its user interface a little bit more friendly. It is for technical people, and most of the technical people would be able to figure it out, but it would be good to improve its user interface.

They can maybe build artificial intelligence into it. Currently, it takes a lot of manpower to analyze and dissect all the data.

I started using it last November. It has been six months.

It was pretty stable. It never crashed.

Scalability could be a challenge because you can analyze so much data with Wireshark, which can be hard if you don't have a very specific case or plan for it. 

If there is no automated solution, scalability could be a little bit difficult. It gives you more visibility into your network, and you can see the packets that are coming in and going out of the network. The only challenge is that if it is a big organization, there would be a lot to process. Having an automated solution on the side would probably help.

I didn't have to contact them.

It was pretty straightforward. It took less than 20 minutes.

I deployed it myself. It does not require any maintenance.

It is free.

I would advise others to have a game plan for it because there is a lot of data that goes into it. You can analyze a lot of data. Having a very strategic game plan would be ideal.

I would rate Wireshark a ten out of ten.