Wireshark.

Wireshark is the leading open-source packet analyzer, originally written by Gerald Combs in 1998 as Ethereal and maintained by a global developer community under the Wireshark Foundation. It captures live traffic from wired, wireless, USB, and other interfaces and decodes thousands of protocols, from Ethernet and TCP/IP to industrial and crypto protocols. Network engineers, blue teamers, malware analysts, and threat hunters use it to diagnose performance issues, validate firewalls, reconstruct attack timelines, and extract files from packet captures (PCAPs).

Under the hood, Wireshark uses libpcap/Npcap to acquire frames and passes each one through a chain of protocol dissectors. Because those dissectors parse fully attacker-controlled input, they are a recurring source of vulnerabilities: 2024 alone brought CVE-2024-2955 (T.38 dissector crash, CVSS 7.5), CVE-2024-9780 (ITS dissector), and CVE-2024-9781 (AppleTalk/RELOAD framing), each allowing denial of service via a crafted capture file or injected packet. The practical lesson is to never open untrusted PCAPs on a production host — analyze them with tshark in a disposable VM, keep the tool patched, and avoid running as root (Wireshark isolates capture in a separate dumpcap process for exactly this reason). Display filters (http.request, tcp.stream eq 3, ip.addr == …) and Follow TCP Stream / Export Objects turn a raw capture into readable sessions and recovered files. Capturing traffic on networks you do not own or administer can violate wiretap and privacy laws, so authorization is essential.

flowchart LR
  A[Network interface] --> B[libpcap / Npcap]
  B --> C[dumpcap capture engine]
  C --> D[Capture file / live buffer]
  D --> E[Dissector chain<br/>Ethernet - IP - TCP - app]
  E --> F[Display filter]
  F --> G[Packet list and detail view]
  G --> H[Follow stream / export objects]