Wireshark captures network traffic and decodes hundreds of protocols so you can see exactly what is crossing the wire.
Common uses
- Troubleshooting connectivity and performance problems.
- Investigating suspicious traffic during incident response.
- Learning how protocols such as DNS, TCP and TLS actually behave.
Useful display filters
dns
tcp.flags.syn == 1 && tcp.flags.ack == 0
http.request.method == "POST"
ip.addr == 192.168.1.10