Wireshark

Wireshark is a GUI-based packet sniffing and analyzer tool which captures live packets from a network interface, dissect their protocols, and displays packet contents in human-readable format. Wireshark relies on libpcap/WinPcap library for packet capture, and cross-platform Qt widget toolkit for user interface. The Wireshark GUI allows users to save/load packets to/from a capture file, search for packets, colorize packets based on coloring rules, define display filters, display TCP/UDP conversations, enable/disable protocols, view packet statistics, and more. Wireshark is useful for network troubleshooting (e.g., diagnosing a slow network, analyze HTTP requests/responses) or network forensic analysis (e.g., identify network attack events). Wireshark supports custom packet dissectors in which user write and plug a custom protocol parser into Wireshark. Wireshark comes with a suite of command-line tools, including tshark (command-line version of Wireshark), editcap (pcap packet dump editor) and mergecap (pcap packet dump merger).