Wireshark

From Wikipedia, the free encyclopedia

Wireshark is a free and open-source packet analyzer. It is used for networktroubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, in May 2006 the project was renamed Wireshark due to trademark issues.

Wireshark is cross-platform, using the GTK+ widget toolkit to implement its user interface, and using pcap to capture packets; it runs on various Unix-like operating systems including Linux, Mac OS X, BSD, and Solaris, and on Microsoft Windows. There is also a terminal-based (non-GUI) version called TShark. Wireshark, and the other programs distributed with it such as TShark, are free software, released under the terms of the GNU General Public License.

[hide]

[edit]Functionality

Wireshark is very similar to tcpdump, but has a graphical front-end, plus some information sorting and filtering options (although similar sorting and filtering can be achieved on the command line by combining tcpdump with grep, sort, etc.). Wireshark allows the user to put the network interfaces that support promiscuous mode into that mode, in order to attempt to see all traffic being passed over the network. On Linux, BSD, and Mac OS X, with libpcap 1.0.0 or later, Wireshark 1.4 and later can also put Wi-Fi adapters into monitor mode.

[edit]History

In the late 1990s, Gerald Combs (a computer science graduate of the University of Missouri-Kansas City), was working for a small ISP. They had plenty of situations where a protocol analyzer would have been handy, but all of the commercial products at the time didn't run on their primary platforms (Solaris and Linux), and were also very expensive. So he started writing a program called Ethereal as a tool to capture and analyze packets ^[2] ; he released the first version around 1998. As of now there are over 500 contributing authors while Gerald continues to maintain the overall code and issues releases of new versions; the entire list of authors is available from Wireshark's website.

The name was changed to Wireshark in May 2006, because creator and lead developer Gerald Combs could not keep using the Etherealtrademark (which was then owned by his old employer, Network Integration Services) when he accepted a job with CACE Technologies.^[3] He still held copyright on most of the source code (and the rest was re-distributable under the GNU GPL), so he took the Subversion repository for Ethereal and used it as the basis for the Subversion repository of Wireshark. In 2010 Riverbed Technology purchased CACE^[4] and took over as the primary sponsor of Wireshark.

Ethereal development has ceased, and an Ethereal security advisory recommended switching to Wireshark.^[5]

Wireshark has won several industry awards over the years^[6], including eWEEK^[7], InfoWorld^[8] ^[9], and PC Magazine^[10]. Wireshark is also the top-rated packet sniffer in the Insecure.Org network security tools survey^[11] and was the SourceForge Project of the Month in August 2010^[12].

[edit]Features

Wireshark is software that "understands" the structure of different networking protocols. Thus, it is able to display the encapsulation and the fields along with their meanings of different packets specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture the packets on the types of networks that pcap supports.

Data can be captured "from the wire" from a live network connection or read from a file that recorded already-captured packets.
Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, TShark.
Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
Data display can be refined using a display filter.
Plug-ins can be created for dissecting new protocols.
VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played.
Raw USB traffic can be captured with Wireshark. This feature is currently available only under Linux.

Wireshark's native network trace file format is the libpcap format supported by libpcap and WinPcap, so it can read capture files from applications such as tcpdump and CA NetMaster that use that format, and its captures can be read by applications that use libpcap or WinPcap to read capture files. It can also read captures from other network analyzers, such as snoop, Network General's Sniffer, andMicrosoft Network Monitor.

[edit]Security

Capturing raw network traffic from an interface requires special privileges on some platforms. For this reason, older versions of Ethereal/Wireshark and tethereal/TShark often ran with superuser privileges. Taking into account the huge number of protocol dissectors, which are called when traffic for their protocol is captured, this can pose a serious security risk given a bug in a dissector. Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developers' doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to OpenBSD 3.6.^[13]

One possible alternative is to run tcpdump, or the dumpcap utility that comes with Wireshark, with superuser privileges to capture packets into a file, and later analyze these packets by running Wireshark with restricted privileges on the packet capture dump file. On wireless networks, it is possible to use the Aircrack wireless security tools to capture IEEE 802.11 frames and read the resulting dump files with Wireshark.

As of Wireshark 0.99.7, Wireshark and TShark run dumpcap to do traffic capture. On platforms where special privileges are needed to capture traffic, only dumpcap needs to be set up to run with those special privileges: neither Wireshark nor TShark need to run with special privileges, and neither of them should be run with special privileges.