If you want to know what is going on on your network or whether some malicious or suspicious software broke in and just started floating around your network, you may want to give Wireshark a try. Wireshark gives you the real answers based on sensitive data about what is actually happening inside your network.
Wireshark was known for many years as Ethereal, and got renamed due to trademark issues in the summer of 2006. With this tool you can capture your network packets on either wired connections (LAN) or wireless connections (WLAN): PPP/HDLC, WiFi, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform). It supports almost all the leading operating systems in the industry, including 64-bit. The supported protocols list is really way beyond your expectation. The major advantage is that the developers are constantly trying to add all the newest protocols defined. As a bonus, by using GeoIP, with Wireshark you can also include or exclude traffic based on a particular country.
The live capture of your network data can be used for further analysis off-line. You can save the captured data into any of the most popular formats.
v1.6 [Jun 7, 2011]
Bug Fixes :
- The Lucent/Ascend file parser was susceptible to an infinite loop.
- The ANSI MAP dissector was susceptible to an infinite loop
- TCP dissector doesn't decode TCP segments of length 1.
- Missing LUA function.
- Lua API description about creating a new Tvb from a bytearray is not correct in wireshark's user guide.
- Character echo pauses in Capture Filter field in Capture Options.
- "File not found" box uses wrong filename encoding.
- Decoding of MQ ASCII and EBCDIC Traffic Flow - ASCII shows fine, EBCDIC does not.
- Tshark custom columns: Why don't I get an error message?
New Features :
- Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets.
- Large file (greater than 2 GB) support has been improved.
- Wireshark and TShark can import text dumps, similar to text2pcap.
- You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window.
- Wireshark can export SSL session keys via File→Export→SSL Session Keys...
- TShark can show a specific occurrence of a field when using '-T fields'.
- Custom columns can show a specific occurrence of a field.
- You can hide columns in the packet list.
- Wireshark can now export SMB objects.
- dftest and randpkt now have manual pages.
- TShark can now display iSCSI, ICMP and ICMPv6 service response times.
- Dumpcap can now save files with a user-specified group id.
- Syntax checking is done for capture filters.
- You can display the compiled BPF code for capture filters in the Capture Options dialog.
- You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. .
- Packet length is (finally) a default column.
A program that lets you easily manage your laptop connections to WiMAX networks
