Wireshark

Wireshark is a packet capture and network protocol analyzer. It lets network engineers and security defenders capture live network traffic, inspect packet headers, and decode thousands of communication protocols.

Network troubleshooting, malware traffic inspection, protocol verification, and incident response triage.

• +Deep protocol dissection for thousands of protocols.
• +Rich display filter syntax for isolating specific traffic patterns.
• +CLI companion (tshark) for automated packet processing scripts.

• +Memory use grows with the number of packets loaded, and Wireshark terminates if it runs out of memory on large captures.
• +Does not perform automated threat correlation on its own.

Analyzing malware communication patterns, verifying encryption standards, and investigating network incidents.