Install wireshark with Homebrew, apk, chocolatey, apt, dnf, Nix, scoop, winget, zypper

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• capinfos
• captype
• dftest
• dumpcap
• editcap
• idl2wrs
• mergecap
• mmdbresolve
• randpkt
• rawshark
• reordercap
• sharkd
• text2pcap
• tshark

Project history

Gerald Combs began writing the project in late 1997 under the name Ethereal because he needed a tool to troubleshoot network problems and wanted to learn more about networking. After development pauses, Ethereal 0.2.0 was released in July 1998, and patches, bug reports, encouragement, and protocol dissectors quickly followed.

The project's extension model and community culture formed early. Contributors often arrived because they needed Wireshark to understand a protocol it did not yet dissect, copied an existing dissector, and sent the new code back. That pattern helped turn the tool into a broad protocol-analysis workbench rather than a single-vendor network sniffer.

In 2006 the project moved and reappeared as Wireshark after the Ethereal trademark stayed with Combs's former employer. The official announcement presented Wireshark as the new home for the world's popular network protocol analyzer, while the migration page encouraged Ethereal users to move forward under the new name.

Wireshark 1.0 arrived in 2008 after ten years of development and coincided with the first SharkFest developer and user conference. Wireshark 2.0 followed in 2015 with a major Qt-based user interface rewrite, and in 2023 the Wireshark Foundation was announced as a 501(c)(3) nonprofit home for the project, SharkFest, development support, and analysis education.

Adoption history

Wireshark's adoption was driven by a simple economic and practical fact: professional protocol analyzers were once expensive, while tcpdump-like tools were powerful but not visual. Wireshark gave network engineers, security practitioners, developers, students, and educators an open-source way to capture, inspect, filter, and explain packets across many protocols.

The project became standard vocabulary in networking and security. The official FAQ describes Wireshark as the world's most popular tool of its kind, used by network professionals, security experts, developers, and educators on Windows, macOS, Linux, and Unix-like systems. Its command-line sibling TShark made the same dissector knowledge useful in scripts, servers, labs, and CI jobs.

How it is used

Wireshark is used to capture live traffic, open saved capture files, decode protocol fields, apply display filters, inspect conversations, troubleshoot network behavior, develop protocols, teach packet structure, and investigate suspicious traffic. It relies on packet-capture libraries and formats such as pcap and pcapng, which also connect it to tcpdump and many other capture tools.

TShark is the terminal version for capturing or reading packets and printing decoded output or writing captures. The surrounding command-line tools support package-nerd workflows: `dumpcap` captures with reduced privilege, `mergecap` combines files, `editcap` slices or transforms captures, `text2pcap` converts textual packet dumps, and `capinfos` reports metadata.

Why package nerds care

Wireshark is one of the rare packages that is both a desktop application and an infrastructure debugging primitive. Even users who never launch the GUI may install it for TShark and the capture-file utilities because they encode Wireshark's protocol knowledge in scriptable tools.

Its history also explains why distributions care about privilege separation and packaging details: packet capture may require elevated rights, but protocol dissection is a large attack surface. The split between capture helpers and analysis processes is part of the tool's operational culture, not just an implementation detail.

Timeline

• 1997: Gerald Combs starts Ethereal to troubleshoot networks and learn networking.
• 1998: Ethereal 0.2.0 is publicly released in July.
• 2006: The project changes name from Ethereal to Wireshark.
• 2008: Wireshark 1.0 is released and the first SharkFest conference is held.
• 2015: Wireshark 2.0 ships with a new Qt-based user interface.
• 2023: The Wireshark Foundation is announced as a nonprofit home for Wireshark and SharkFest.

Related projects

• TShark is the command-line network protocol analyzer distributed with Wireshark.
• tcpdump, libpcap, Npcap, and WinPcap are adjacent capture tools and libraries in the same packet-analysis ecosystem.
• Stratoshark later extended Wireshark-style inspection ideas toward cloud forensics under the Wireshark Foundation umbrella.

Sources

• https://blog.wireshark.org/2015/11/let-me-tell-you-about-wireshark-2-0/
• https://blog.wireshark.org/2023/03/announcing-the-wireshark-foundation/
• https://www.wireshark.org/docs/man-pages/tshark.html
• https://www.wireshark.org/docs/wsug_html_chunked/ChIntroHistory.html
• https://www.wireshark.org/faq
• https://www.wireshark.org/migration
• https://www.wireshark.org/news/20060607.html