Wireshark Reviews

My work includes a feature that allows me to download traffic between different points, whether internal, external, or general. I use Wireshark to analyze this traffic. I also use it mostly for threat hunting.

I look at aspects like who is downloading the most data and who are the most active. I also check which country is generating the most traffic. It helps in analyzing if something looks suspicious, such as a brute force attack or scanning from somewhere. It assists in identifying source and destination and possible data extraction, which is helpful for incident response.

I have not used Wireshark to an advanced point where I could provide a detailed opinion on improvements needed. I find it to be a very useful tool beyond other traffic analysis tools.

I have been using Wireshark for more than five years now.

I have not faced any issues with stability.

Wireshark does everything I need.

I have never contacted their support team.

I was using Splunk about three months ago and tried to ingest some Wireshark captures.

I recommend Wireshark to other people.

I'd rate the solution eight out of ten.

Wireshark is a network analyzer used to capture traffic. It's used to analyze patterns in the network to check for any malicious traffic generated from devices or endpoints.

Wireshark is a good tool to start with network analyzing and packet capturing. The solution provides good performance and stability.

The solution’s user interface could be improved.

I have been using Wireshark since 2019.

Wireshark is a stable solution.

Wireshark is not a scalable solution. The tool's purpose is not to scale, and there is no use case to scale it.

The solution’s initial setup is straightforward.

I have deployed Wireshark on my laptop. You need to download the software from the web and then run it. It's free of charge, and there's no license involved. We need to enable the solution and run it to capture the traffic.

Wireshark is free of charge, and there's no license involved.

I would recommend the solution to other users. Wireshark is a good tool to start with network analyzing and packet capturing. You can use Wireshark for packet capturing to find the root cause of any issues in the network.

Overall, I rate the solution an eight out of ten.

When we can see in the customer environment that traffic is getting blocked; suppose we have a VPN channel, and when the VPN channel is up but the traffic is not running through it, we use Wireshark to recapture the channel. We check whether the PPP handshake is ongoing or not. The acknowledgment team posts this packet, and after that, the PPP handshake is ongoing or not. 

So these are the things that we check by filtering out the things and based upon that, we get support. Because in five to six seconds, there are more than a thousand packets. So we have to filter out and check on which speed it is getting dropped. For that reason, we are using Wireshark. I am using it just for troubleshooting purposes.

Wireshark is pretty handy. It's especially useful for troubleshooting issues. However, the GUI interface is not that accurate. It can only show a limited amount of information, such as the source code, destination code, and services that are being blocked. If we want to know why a packet is being blocked by a particular policy, we need to check the packet capture.

We also use Wireshark to troubleshoot packet-level inspection issues, such as whether the payload is present, whether the packet size is too large for the receiver, and whether the DMTU (Dynamic Maximum Transmission Unit) is correct. We also use it to troubleshoot issues with fragmented packets.

In addition to the GUI, we also use the developer's tool and the command line to troubleshoot issues with Wireshark. For example, we use the cat and grep commands to filter out the information we need and to turn on debug mode. We also use the tail command to view the current history of logs.

I am currently working in a Linux environment, so I use the SysLog for configuration purposes on the Algo server. I use the TCP system command because Cisco uses port 514. So, I have to use the TCP system command to check whether we are receiving logs from the particular firewall or not.

Customers often tell us that they have open WDP 5144 traffic. They usually show us this in Splunk. For example, they might say, "We are forwarding the packet to the system, but we are not receiving the packet." This is usually because they need to test their end because they require some identity virus for the traffic to flow through our application.

Sometimes, the Algo server goes down, and we have to build it from scratch. Other times, the load distribution unit does not get synced with the primary. These are just some of the things we do on a daily basis with Wireshark.

While Wireshark is useful, the GUI interface is less accurate, showing only limited information.

I have been using Wireshark for three years. 

It is a stable product. I would rate the stability a ten out of ten. Every engineer in our organization uses this solution in our company. So, more than 22 users are using this solution. 

I would rate the scalability a nine out of ten. There is always room for improvement. 

It is easy to scale Wireshark. The GUI is very user-friendly. They have multiple videos online and on YouTube. Going through these resources provides a better understanding of Wireshark, its functionality, and how things operate within it. Essentially, it aligns with what we can learn from fundamental books or authoritative works.  

What we have analyzed on a theoretical basis, like the TCP handshake, SSL handshake, wireless controller handshake, SMTP handshake, and whatever we read in the books, we can technically see it in Wireshark each and every packet. For SSL, we can see multiple streams getting transmitted: server, client hello, client-server hello, then the client where Client Pre-shared. The client ciphers also send the TLS, TLS certificate SSL certificate. Then in the server, we can see the SSL certificate and the Cypress suite, which they want to negotiate on, and then their pre-master secret key, which is generated, and then the session keys are getting generated. So these are all the things that we read in our books; we can see it packet-wise, each and everything. The acknowledgment comes from their end, from the client or the server side. So we can see it is very much easy to use in Wireshark.

Gain practical knowledge of what we comprehend. Analogous to the basic mathematical concept of two plus two, this is a protocol-oriented understanding, similar to the alphabet in language. However, in the realm of networking, Wireshark proves highly beneficial. You can put into practice what you read in books by actively examining and validating it yourself.

Every engineer will always try to make things easy for the customer. S 

Positive

The initial setup depends upon the basics. You need to have a clear understanding of the basics. When you have a clear understanding, there's nothing more difficult for us.

We have deployed it both on the cloud and on-premises. We usually install agents from Google. Everyone cannot use it. At least we need to have a basic understanding of theoretical concepts. Once the theoretical concept is clear, then you can use the packet capture. So it is easy to do packet captures. You need to just check videos on YouTube.

Overall, I would rate the solution a nine out of ten. Just focus on the basics. Once they are clear, you can handle and master any of the products in the secure network market, whether it's switches, routers, firewalls, VPNs, load balancers, or whatever it is. Just focus on the basics of what you want to pursue in your career.

Wireshark is a packet analysis tool. We check Wireshark when we don't know what's causing an issue.  The network packets never lie. Three people on my company's network team use Wireshark. 

It's an efficient solution for determining unexplained issues. It helps us rule out the network as the cause of an issue. When people don't know the reason for a problem, they always believe it's the network. Wireshark enables us to prove ourselves to the other teams. 

Wireshark is a simple solution. 

Wireshark doesn't have a dashboard. 

We have been using Wireshark for around 10 years.

Wireshark is stable. 

Wireshark is scalable.

Setting up Wireshark is easy and usually takes about 10 to 15 minutes. 

Wireshark is open source, but you can pay for support. 

I rate Wireshark seven out of 10. If you use the free version, you can't get technical support, but it's cost-effective. When you first use Wireshark, it can seem complex, but it's an effective solution once you get used to it. Packet analysis is complicated, but it's the best way to do the job once you understand the solution.

I have been using Wireshark for the packet tracing, and it has helped me to find out whatever site, et cetera. It is useful, basically capturing packets of data on the network.

It helps us to identify the source the packet is originating from and it also helps us to know about the return time of the packet from when the packet is going from our computer to when it reaches the destination IP address. It helps diagnose internet connectivity problems and also helps us to know what the website data consists of and how much data is in the website.

And it also helps us to know about the various protocols which are being utilized when we are connecting to the internet. We also get to know what bites, et cetera, are present in our data or if there is any malicious packet that is not supposed to come in. Based on it, we can configure our firewall. 

It's helping me to get to know about the packet data. I'm getting to know about the source destination IP, for example. That's quite useful to me. 

Overall, it's a great product. 

The initial setup is simple. 

It is stable. 

Whenever we select one of the packets, in terms of the number of bytes, for example, there are three planes, and in the detailed plane, I have to count the number of bytes manually. 

Also, sometimes when I'm trying to select the number of bytes, the selection does not go properly. If we were to go on selecting it, the number of bytes also showed up as to how many bytes have been selected in the detailed plane.

I've been using the solution for four months.

It's quite stable. I don't have any issues with Wireshark while running it. There are no bugs or glitches. It doesn't crash or freeze. 

Scalability is good. I can capture as few or as many packets as I want. There's no issue at all. 

That said, I haven't worked on it professionally, so I cannot comment much on that right now from an organizational perspective.

I've never called technical support. I can't speak to how helpful or responsive they are. 

I did not use another similar product before. 

The implementation process is not complex at all. You just have to click on the interface, and your Wireshark starts capturing the packets. 

I'm not aware of the exact pricing. 

I'm an end-user. I'm using it at my college.

I would recommend Wireshark for various network diagnostic purposes.

I'd rate the solution nine out of ten.

We use this solution for troubleshooting network issues.

The strongest feature of this solution, is the ability it gives us to carry out deep-packet inspections on our network, particularly when a function isn't performing as it should.

We would like the product to be developed so that it doesn't rely on internet access for installation. We would like to see all of the components required to be integrated into the installer.

We have been working with this solution for around three years.

This is a very stable product.

We have found this solution to be scalable across all operating systems.

The initial setup of this solution is very simple.

We are using a freeware version of this solution, so there are no licence costs involved.

We would rate this solution a nine out of ten.

We use Wireshark to check the network traffic, and if there's any network problem or issue, we can check it through the tool. We also use Wireshark during analysis, to check if there's any network connectivity or attempts from the malware to communicate with the C&C server. We use the tool for further analysis and investigation.

I find Wireshark a very useful tool. Its best feature is that it allows me to deeply understand what's going on at the packet level, as well as any adverse signatures that I can analyze. When I need to create an IPS rule, I need to check the traffic deeply to get more insights about the actual traffic, what's the name of certain flags, etc., and I'm able to do all that through Wireshark.

The tool is also user-friendly.

A room for improvement in Wireshark is its ease of use for beginners. It could be better. Another room for improvement in the tool is for it to provide more details about the traffic load.

At the moment, Wireshark is adequate for me, so there isn't anything I'd like added to it in its next version.

I've been using Wireshark for a long time, so I can't remember the exact number of years I've been using it.

Wireshark is a stable tool. I didn't see any issues with its stability.

Wireshark is a scalable tool.

We never raised an issue or ticket with the Wireshark technical support team.

The setup process for Wireshark was very simple.

We're using the free version of Wireshark.

We didn't try to use other solutions apart from Wireshark.

Two hundred people use Wireshark within the company.

My rating for Wireshark is a nine out of ten because I like it and I use it so much.

I'm only a user of Wireshark.

I use Wireshark to analyze packets, especially network packets.

Wireshark's best feature is that it's adaptive, which means it's the go-to tool for network-related developers, as when the new protocol comes up, it's rapidly applied to the system, so I can just look into the packet. For example, I'm working in the automotive industry, and Wireshark supports some IP protocols, which not many tools do.

Wireshark's UI isn't easy to handle and doesn't have as nice a view as Omnipeek.

I've been using Wireshark for over twelve years.

Wireshark is stable. When it changed its UI from a legacy one to the acute, there were some crashes, but that was a while ago, and now it's pretty much stable.

Wireshark provides some macro functions and a custom parse protocol for the new protocols, so it's quite scalable.

As it's open-source, Wireshark's customer service isn't as sophisticated as private products. Developers are welcome to contribute their help, but if no one is interested in your particular issue, there's likely no mode to come up with a solution. 

The initial setup was straightforward and only took a couple of minutes to complete.

We use the free, open-source version of Wireshark.

The most important thing for new users of Wireshark is to get used to the filtering functions because all the filters are based on command input, so the ability to organize the right filter is essential. I would rate Wireshark eight out of ten.

It's a tool that we use to capture the network and if there is any lag or if there are packet drops.

It's a very useful tool. We are using it to monitor any network depreciation. For example, suppose there's a call going on between two IP phones and one person says that I cannot hear you. There's definitely something wrong. The RTP is getting dropped, and the packets are getting dropped. We need to capture the live call or if there are any prerecord calls for this particular time period. We go ahead and use this tool to find out whether the packets dropped when a packet is dropped and what caused the audio issue or video issue. We actually use it to understand any network issues.

I've been using it for quite some time, and I find that it's very user-friendly. The interface is good. 

The options that are required to get the details for the packet drops are good. All the options are available for whatever is required. I can choose any of them and search easily, and I can also pull the report and publish it to the team or whoever requires it. 

It's easy to set up.

I can't suggest anything as of now regarding Wireshark. I have never found any issues or had any difficulty using it. Be it connecting the system to the network directly and capturing the data through Wireshark, or for a specific time, it's been flawless. I have got the results every time I've needed them. 

You need good network connectivity to download during the setup, otherwise, it might take a while.

I have been using Wireshark for almost six years. I've used it for a while at this point.

The solution is stable. It's reliable. It offers good performance There are no bugs or glitches. It doesn't crash or freeze. 

Almost everybody in our company is using the product. That's likely around 1,000 people. Here, we always work on the network devices, and we need to use this tool to understand if there is any issue with that network or if there is any issue with the calls. Therefore, almost everyone uses it within the network team.

In terms of scalability, if you look at it, there's no limit. There's no restriction on how many users can use it. However, it depends on the organization. If you need any approval to download it usually needs special permission. 

I never had to reach out to technical support regarding Wireshark. Whenever I've had to use it, it worked properly and there was no issue to complain about.

It is easy to set up. We just need to download it and choose the options while setting it up. That's it. After that, it should be done.

The download itself doesn't take a lot of time. It depends on the bandwidth of your network. If you're using a good network connection, then it hardly takes a minute to download.

It is open-source. Anyone can download and use it. 

I use the solution to support my customer's environment. I am not a partner or reseller. 

I'd rate the solution ten out of ten.

Wireshark is more of a packet capture tool. If you are in a network environment, where you are supporting the customer and looking after the issues with network drop, network devices, or IP calls, you must have a Wireshark on your PC. This is a tool that gives you a clear-cut idea about where the issue is, and where the packs are dropping. It's an excellent tool. Everyone should start using it.

I work on WiFi and I am a customer engineer. We use Wireshark to analyze the sniffer captures or tcpdumps. That's the purpose of the solution.

There are very handy filters available in Wireshark.

It’s free and doesn’t cost us anything to use.

The product is simple to implement.

It is a stable solution.

In my previous company, we had Omnipeek, and the UI was better than Wireshark. This product needs to improve the UI.

Generally, you can use Omnipeek to capture packets. You can also use Wireshark to capture packets. However, they need a compatible adapter. If we use Wireshark without a compatible adapter, we really don't go to capture packets using it. We already get captures from the field and from customers, and we just use it for analysis.

I would make maybe adding filters easy. There are some options that we can enable to look into the packet. For example, the default installation of Wireshark doesn't have much information. You can just get to see the packet number, the time's terms, the source address, the destination address, and some detailed information. If I want to see the RSSI, the channel number, the protocol information, or the data rate, I need to go and modify some of the configurations to add columns to display this information. I need to spend some time with it. Therefore, the Wireshark default installation could probably include some more crucial information. That would be a little helpful.

It's been a pretty long time since I started using the product. It’s been more than five years.

Wireshark in general is good. It is stable. We have used it on Windows. We have used it on Linux. We have used it on MacBook and it works pretty well on every platform.

The solution is scalable in the sense you can add it to however many laptops you need to. It's not like you have 500 people using the same Wireshark or using a common license. It is installed on everyone's PC and whoever wants to use it can. We are using the free version. Therefore, getting more people to put it on their PCs also doesn’t cost the company more.

In our company, about 150 people, or many a few more, are using the solution.

We’ve never had the need to reach out to technical support.

I used Omnipeek. The UI was better than Wireshark. However, it is quite expensive.

If somebody pays for Omnipeek that heavy price, they also prefer to get a compatible adapter or a compatible card that works with Omnipeek.

In this company, people just use the solution. However, there wasn’t a discount moment when management suggested it to everyone.

The initial setup was pretty easy. It was straightforward. We didn’t find it to be difficult.

It only takes a few minutes to get everything up and running.

The solution is free to use. We do not have to pay any licensing fees.

I’m a customer and end-user.

The solution is installed on my PC.

Wireshark is a pretty good tool if somebody wants to learn packet analysis or just plain, simple debugging of network issues at an L2 or L3 level. It is quite good for anybody, even a beginner. Anybody can use this tool and the installation is simple. The default installation should work quite well.

I’d rate the solution eight out of ten. If they could make the UI a little better and help us to get some more crucial information easily while providing some options to enable certain parameters based on the protocol, I’d give it a ten out of ten.