[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Wireshark? The Free Network Sniffing Tool](/blog/what-is-wireshark) Publish date November 28, 2025 {x} minute read # What is Wireshark? The Free Network Sniffing Tool [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Wireshark is a free open source tool that analyzes network traffic in real-time for Windows, Mac, Unix, and Linux systems. It captures data packets passing through a network interface (such as Ethernet,  LAN, or SDRs) and translates that data into valuable information for IT professionals and cybersecurity teams. Wireshark is a type of packet sniffer (also known as a network protocol analyzer, protocol analyzer, and network analyzer). Packet sniffers intercept network traffic to understand the activity being processed and harvest useful insights. Wireshark (formerly known as ethereal) offers a [series of different display filters](https://www.networkdatapedia.com/post/2019/01/29/top-10-wireshark-filters) to transform each captured packet into a readable format. This allows users to identify the cause of [network security](https://www.upguard.com/blog/network-security) issues and even discover potential cybercriminal activity. When a packet sniffer is used in 'promiscuous mode' users can analyze network traffic regardless of its destination - like a fly on a wall watching office activity. While this empowers IT professionals to perform a quick and thorough diagnosis of network security, in the wrong hands, Wireshark could be used for cyberattack reconnaissance campaigns. Because you can [download Wireshark for free](https://www.wireshark.org/), cybercriminals have liberal access to it, so it's best security practice to assume the software is currently being used with hostile intentions. Luckily, there are some security measures you can implement to [protect against network sniffing](https://www.upguard.com/blog/what-is-wireshark#toc-how-to-protect-against-network-sniffing). ## What is Wireshark Used For? Packet analysis software like Wireshark is used by entities that must remain informed about the state of security of their network, as such, the software is commonly used by governments, schools, and technology businesses. Common Wireshark use cases include: * Identify the[ cause of a slow internet connection](https://www.youtube.com/watch?v=uzhIAMtZpM8) * [Investigating lost data packets](https://www.youtube.com/watch?v=mQ8CbakZLFU) * [Troubleshooting latency issues](https://www.youtube.com/watch?v=PLvrvfHPvWI) * [Detecting malicious network activity](https://www.youtube.com/watch?v=NoJO51-UVvA) * [Identify unauthorized data exfiltration](https://www.upguard.com/blog/how-to-detect-data-exfiltration) * [Analyzing bandwidth usage](https://osqa-ask.wireshark.org/questions/54395/determine-real-bandwidth-usage/) * [Tracing voice over Internet (VoIP) calls over the network](https://www.youtube.com/watch?v=uZI9ZnKRudg) * [Intercepting Man-in-the-Middle (MITM) attacks](https://www.youtube.com/watch?v=-rSqbgI7oZM\&t=204s) Wireshark makes all of the above use cases possible by rendering and translating traffic into readable formats - saving users the frustrations of having to translate binary information manually. All of this is done in real-time so that detected issues can be rapidly addressed before they develop into a service outage, or worse, a [data breach](https://www.upguard.com/blog/data-breach). ## How to Use Wireshark Before following a Wireshark tutorial, it's important to understand how networking systems work. The OSI model (Open Systems Interconnection Model) is a framework that represents how network traffic is transferred and displayed to an end-user. It's comprised of 7 layers * **Application (Layer** **7) **- Displays the graphical User Interface (UI) - what the end-user sees * **Presentation (Layer** **6)**  - Formats data to achieve effective communication between networked applications * **Session Layer (Layer 5)** - Ensures connections between end-points are continuous and uninterrupted. * **Transports Layer (Layer 4)** - [Proxy servers](https://www.upguard.com/blog/proxy-server) and firewalls reside on this layer.  Ensures error-free data transfer between each endpoint by processing TCP and UDP protocols. At this layer, Wireshark can be used to analyze TCP traffic between two IP addresses * **Network Layer (Layer 3) **- Ensures routing data for routers residing on this network are error-free. * **Data Link Layer (Layer 2) **- Identifies physical servers through two sub-layers, Media Access Control (MAC), and Logical Link Control (LLC). * **Physical Layer** **(Layer** 1**) **- Comprised of all the physical hardware that processes network activity To use correctly use Wireshark, you must be aware of the different proctors being processed at each OSI layer. This will help you decide which layer should be analyzed for each specific diagnostic requirement. Here's a run-through of the protocols being processed at each OSI layer: * **Application (Layer** **7) **- SMTP, HTTP, FTP, POP3, SNMP * **Presentation (Layer** **6)**  - MPEG, ASCH, SSL, TLS * **Session Layer (Layer 5)** - NetBIOS, SAP * **Transports Layer (Layer 4)** - TCP, UDP * **Network Layer (Layer 3) **- IPV5, IPV6, ICMP, IPSEC, ARP, MPLS. * **Data Link Layer (Layer 2) **- RAPA, PPP, Frame Relay, ATM, Fiber Cable, etc. * **Physical Layer** **(Layer** 1**) **- RS232, 100BaseTX, ISDN, 11. Each layer is stacked on top of the other and information flows between each layer during network activity. Even with just a surface-level understanding of the different functions of each layer, you can perform a high-level assessment of networking issues. For example, if you're having issues browsing the internet, you can assume that there's likely an error on the Network Layer (layer 3) since it processes router data. Wireshark can then be used to further investigate such an assumption. It can confirm which layer is failing and the specific protocols that contain errors. Now that you've established some foundational background knowledge, you will get the most value from the following Wireshark tutorial [YouTube video player](https://www.youtube.com/embed/TkCSr30UojM?controls=0) If you're struggling to understand any of the above concepts, you will need to develop some essential skills before using Wireshark. A thorough understanding of each of the following concepts is a prerequisite to using Wireshark. Each item on the list links out to an article offering more information should you wish to fill any essential knowledge gaps. * [Networking basics](https://www.softwaretestinghelp.com/computer-networking-basics/) * [Mechanics of network packets](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-a-packet/) * [Three-way TCP handshakes](https://www.sciencedirect.com/topics/computer-science/three-way-handshake) * [TCP/IP stack](https://isaaccomputerscience.org/concepts/net_internet_tcp_ip_stack) * [TCP protocols](https://www.comparitech.com/net-admin/ultimate-guide-tcp-ip/) * [UDP protocols](https://www.comparitech.com/net-admin/guide-udp-user-datagram-protocol/) * [DHCP protocols](https://docs.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-top) * [ICMP protocols](https://www.sciencedirect.com/topics/computer-science/internet-control-message-protocol) * [How to read and interpret captured packet headers](https://networklessons.com/cisco/ccna-routing-switching-icnd1-100-105/ipv4-packet-header) * [How routing works](https://www.computernetworkingnotes.com/ccna-study-guide/basic-of-ip-routing-explained-with-example.html) * [How port forwarding works](https://stevessmarthomeguide.com/understanding-port-forwarding/) ### Additional Wireshark Eesources Wireshark offers a wealth of free resources to help you master network analysis with its product. They can be accessed from [the Wireshark website](https://www.wireshark.org/docs/). ## How to Protect Against Network Sniffing The probability of an organization suffering a data breach is rising, and from this, we can infer that network sniffing is also on the rise since they [facilitate cyberattacks](https://www.upguard.com/blog/cyber-attack). The following security controls could prevent network sniffing. ### Keep Antivirus Software Updated Network sniffers are usually delivered through trojans, [worms](https://www.upguard.com/blog/computer-worm), viruses, and [malware](https://www.upguard.com/blog/malware). Antivirus software could block such hostile payloads before they have a chance to deploy a sniffing campaign. To increase the chances of successful protection, it's important to keep antivirus software updated so that it's configured to detect the latest [cyber threats](https://www.upguard.com/blog/cyber-threat). ### Encrypt All Network Data When network data is encrypted, it's difficult for cybercriminals to glean sensitive information from it in a sniffing campaign. There are [different types of encryption methods available](https://www.upguard.com/blog/encryption), but for the highest degree of obfuscation, the Advanced Encryption Standards (AES) should be used. This encryption algorithm is impervious to almost all forms of cyberattacks (except [brute force attacks](https://www.upguard.com/blog/brute-force-attack)), this is why it's the preferred encryption method of the United States government. ### Use a VPN Virtual Private Networks (VPNs) secure all internal traffic in an encrypted tunnel. They also secure remote connections to sensitive internal networks, so that businesses can maintain a remote workforce without compromising on security. For the best results, choose a VPN that uses AES encryption and couple it with antivirus software that's always kept updated. ### Disable UPnP Universal Plug and Play (UPnP) could allow cybercriminals to connect to your router and deploy network sniffing software. These connections could occur autonomously, outside of your control, because that's what UPnP is designed to do Most new routers come with UPnP already enabled, so you could currently be exposing your network to sniffing attacks without knowing it. [Read this post](https://www.upguard.com/blog/what-is-upnp) to learn more about UPnP and how to disable it. ### Only Interact with Secure Websites Protected websites encrypt all of the data that's submitted to them. Submissions occur through any website element that accepts user input. This includes contact forms, login fields, and even payment information fields. A secure website can be identified in two ways: 1. The URL of a secure website begins with HTTPS. The insecure websites don't include an "s", they begin with just HTTP. 2. Secure websites display a tiny locked padlock before their URL. Insecure websites display an unlocked padllock ### Do Not Connect to Public Wi-Fi The security of public Wi-Fi can never be confirmed. You can never be certain that they even encrypt their data. Cybercriminals often set up malicious free Wi-Fi hotspots so that they can monitor the activity of connected devices. DIscovering a Wi-Fi hotspot that doesn't require a password may seem like a life-saver, but their potential security risks greatly outweigh any of the benefits they might offer. Best to avoid all public Wi-Fi hotspots. ### Use a Third-Party Attack Surface Monitoring Solution The chances of network sniffing attacks are high if operating systems and third-party software are not updated with the latest patches. A [cyber risk remediation software](https://www.upguard.com/product/vendor-risk/risk-remediation) solution will alert you if any of your vendors are exposed through [security vulnerabilities](https://www.upguard.com/blog/vulnerability), including unpatched software. Cybercriminals can access your internal network through a compromised vendor. This is a very real and very dangerous threat. By remediating vendor vulnerabilities before they're exploited by cyber attackers, the chances of your vendors becoming [attack vectors](https://www.upguard.com/blog/attack-vector) for networking sniffing campaigns are diminished. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)