Alternatives to Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
Replacements
Listings that take over the same core job as Wireshark.
tcpdump
The classic command-line packet capture and analysis tool.
tcpdump is a BSD-licensed command-line capture tool found on nearly every Unix system, writing standard pcap files, but without Wireshark's graphical dissection and filtering interface.
Termshark
Terminal interface for tshark that feels like Wireshark.
Termshark brings a Wireshark-style interface to the terminal using tshark, so it works over SSH on macOS and Linux, with fewer features than the graphical application.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
NetworkMiner offers a host-centric view that reconstructs files and credentials from captures on Windows and Linux, with some parsers limited to the paid Professional edition.
ngrep
A command-line packet capture tool that matches network payloads against regular or hexadecimal expressions.
ngrep is a lightweight command-line tool that greps packet payloads with BPF filters, but provides text output only with no protocol decoding.
Similar software
Related functionality, not a direct replacement.
Nmap
The network mapper: find out which hosts are up, which ports are open and what is listening on them.
Angry IP Scanner
A fast, friendly IP and port scanner that needs no installation and runs on Windows, Mac and Linux.
Npcap
Windows packet capture driver used by Wireshark, Nmap and similar tools.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Arkime
Store and search captured network traffic through a web interface.
RustNet
Terminal network monitor showing live connections per process with packet inspection.
