Wireshark

Wireshark is the world's leading network protocol analyser, and it is free open source software. In network diagnostics it occupies an unusual position: it is simultaneously the most capable tool available and the one that costs nothing, which is why it is effectively the default across the industry rather than a budget alternative. When a network problem cannot be explained by monitoring dashboards, the answer is usually found by capturing packets and reading them, and Wireshark is the tool that does that.

What sustains it is the surrounding ecosystem rather than the binary alone. The project publishes a user's guide, extensive documentation, a wiki, sample captures for practising against realistic traffic, and a developer's guide. Sample captures matter more than they appear to, since learning protocol analysis requires examples of both normal and pathological traffic, and assembling those independently is difficult.

Several practical utilities are published alongside: OUI lookup for identifying hardware vendors from MAC addresses, a WPA PSK generator, an IPv4 and IPv6 test, a modeline generator and a capture filter generator. The capture filter generator is genuinely useful, since filter syntax is where most newcomers to packet capture get stuck.

The community is unusually well developed for an open source project, with mailing lists, a Discord, an Ask Wireshark question site, a podcast, a blog, and SharkFest, its own conference, with a 2026 European edition in Brussels. Formal certifications exist, which matters professionally since packet analysis skill is otherwise hard to evidence on a CV. Stratoshark is a related newer project. The source code, issue tracker and release notes are public, and the project accepts donations and contributions.