Wireshark

Infobox software



caption = Wireshark on Ubuntu
developer = The Wireshark team
latest_release_version = 1.0.3
latest_release_date = release date|2008|09|3
latest_preview_version = 1.1.0
latest_preview_date = release date|2008|09|14
operating_system = Cross-platform
programming_language = C
genre = Packet sniffing
license = GNU General Public License
website = [http://www.wireshark.org/ www.wireshark.org]

Wireshark is a free packet sniffer computer application. It is used for network troubleshooting, analysis, software and communications protocol development, and education. In June 2006 the project was renamed from Ethereal due to trademark issues.

The functionality Wireshark provides is very similar to tcpdump, but it has a graphical front-end, and many more information sorting and filtering options. It allows the user to see all traffic being passed over the network (usually an Ethernet network but support is being added for others) by putting the network interface into promiscuous mode.

Wireshark uses the cross-platform GTK+ widget toolkit, and is cross-platform, running on various computer operating systems including Linux, Mac OS X, and Microsoft Windows. Released under the terms of the GNU General Public License, Wireshark is free software.

History

Out of necessity, Gerald Combs (a computer science graduate of the University of Missouri-Kansas City) started writing a program called Ethereal so that he could have a tool to capture and analyze packets; he released the first version around 1998. Pretty soon, this protocol analyzer caught on. As of now there are over 500 contributing authors while Gerald continues to maintain the overall code and issues releases of new versions. The entire list of authors is available from Wireshark's web-site.

The name was changed to Wireshark in June, 2006, because creator and lead developer Gerald Combs could not keep using the Ethereal trademark (which was then owned by his old employer, Network Integration Services) when he changed jobs. [cite web |url=http://www.wireshark.org/faq.html#q1.2 |title=What's up with the name change? Is Wireshark a fork? |work=Wireshark: Frequently Asked Questions |accessdate=2007-11-09] He still held copyright on most of the source code (and the rest was redistributable under the GNU GPL), so he took the Subversion repository for Ethereal and used it as the basis for the Subversion repository of Wireshark.

Ethereal development has ceased, and an Ethereal security advisory recommended switching to Wireshark. [ [http://www.ethereal.com/appnotes/enpa-sa-00024.html Ethereal: enpa-sa-00024 ] ]

eWEEK Labs named Wireshark one of "The Most Important Open-Source Apps of All Time" as of May 2, 2007. [cite web |url=http://www.eweek.com/slideshow_viewer/0,1205,l=&s=25947&a=206265&po=6,00.asp?p=y |title=The Most Important Open-Source Apps of All Time - Wireshark |publisher=eWeek |accessdate=2007-11-09]

Features

Wireshark is software that "understands" the structure of different networking protocols. Thus, it is able to display the encapsulation and the fields along with their meanings of different packets specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture the packets on the networks supported by pcap.

* Data can be captured "from the wire" from a live network connection or read from a file that records the already-captured packets.
* Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
* Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, tshark.
* Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
* Display filters can also be used to selectively highlight and color packet summary information.
* Data display can be refined using a display filter.
* Hundreds of protocols can be dissected.

Wireshark's native network trace file format is the libpcap format supported by libpcap and WinPcap, so it can read capture files from applications such as tcpdump and CA NetMaster that use that format. It can also read captures from other network analyzers, such as snoop, Network General's Sniffer, and Microsoft Network Monitor.

Security

Capturing raw network traffic from an interface requires special privileges on some platforms. For this reason, older versions of Ethereal/Wireshark and tethereal/tshark often ran with superuser privileges. Taking into account the huge number of protocol dissectors, which are called when traffic for their protocol is captured, this can pose a serious security risk given a bug in a dissector. Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developers' doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to its 3.6 release. [ [http://www.openbsd.org/cgi-bin/cvsweb/ports/net/ethereal/Attic/Makefile?hideattic=0&only_with_tag=HEAD CVS log for ports/net/ethereal/Attic/Makefile ] ]

One possible alternative is to run tcpdump, or the dumpcap utility that comes with Wireshark, with superuser privileges to capture packets into a file, and later analyze these packets by running Wireshark with restricted privileges on the packet capture dump file.

As of Wireshark 0.99.7, Wireshark and tshark run dumpcap to do traffic capture. On platforms where special privileges are needed to capture traffic, only dumpcap needs to be set up to run with those special privileges - neither Wireshark nor tshark need to run with special privileges, and neither of them should be run with special privileges.

Ports

Wireshark runs on Unix and Unix-like systems, including Linux, Solaris, HP-UX, FreeBSD, NetBSD, OpenBSD and Mac OS X (although GTK+ only works with X11 on Mac OS X, so the user will need to run an X server such as X11.app), and on Microsoft Windows.

References

External links

* [http://www.wireshark.org/ Wireshark official website]
* [http://wiki.wireshark.org/ Wireshark wiki]
* [http://sourceforge.net/projects/wireshark/ Project on SourceForge]
* [http://www.linux.com/feature/54968 Ethereal changes name to Wireshark] — the view of lead developer Gerald Combs.
* [http://www.network-research.org/mp2tsdis.html Ethereal MPEG-2 TS Dissector] - An MPEG-2 TS dissector patch for Ethereal/Wireshark.