thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Networking Fundamentals · Foundational

Wireshark

A free, open-source graphical protocol analyzer that captures and decodes network packets.

Definition

Wireshark uses display filters such as ip.addr==10.1.1.5, tcp.port==443 and dns, and capture filters in BPF syntax. It reads pcap and pcapng files from tcpdump and other tools.

Example

Filtering on tcp.analysis.retransmission highlights lost segments.

Exam tip

Display filters (ip.addr==) differ from capture filters (host 10.1.1.5).

Related terms