Wireshark is a Unix or Windows packet capture and analysis tool. Unlike tcpdump or tools such as RawCap, Wireshark is a GUI-based tool that has a number of features for not only packet capture, but also analysis. As a result, it may be difficult to deploy rapidly during an incident as the program has to be installed. Furthermore, the tool is only supported on the Windows and Mac operating systems. To install on a Linux system requires a bit more effort. The one distinct advantage that Wireshark has over the command-line options is that incident response analysts can perform a detailed inspection of the traffic as it is being captured.
Wireshark can be run on the system itself or run on a USB. Once installed, it has to be run as ...
