Article
Ten years of Ethereal
Wireshark was born in 1998 as Ethereal, developed by Gerald Combs at Missouri Research and Education Network. From June 2006 the project changed name to Wireshark — Combs left his previous job keeping the trademark but not the Ethereal naming held by the previous employer. On 31 March 2008 version 1.0 is released, a symbolic milestone ten years after birth.
GPL v2 licence. The project is backed by a consortium of sponsors and the global community.
What Wireshark does
Protocol analyser — captures network packets (libpcap on Linux/macOS, WinPcap/Npcap on Windows) and dissects them per protocol specifications, presenting a hierarchical view to the user: Ethernet → IP → TCP/UDP → application protocol.
As of 2008 it supports about 1000 protocols. The list includes everything realistically seen on networks: IP/IPv6, TCP/UDP, DNS, DHCP, HTTP/HTTPS (+TLS decrypt with keys), SMB/CIFS, SMTP/POP/IMAP, FTP, Telnet, SSH, SSL/TLS, VoIP protocols (SIP, RTP), industrial (Modbus, DNP3, S7), wireless (802.11, Bluetooth).
Components
- wireshark — GTK+ GUI
- tshark — CLI equivalent for scripting and automation
- dumpcap — privileged capture daemon (lets UI run without root)
- editcap, mergecap, rawshark — accessory tools
- capinfos — PCAP file statistics
- text2pcap, pcap2xml — conversions
Practical use
Typical scenarios:
- Network troubleshooting — sysadmins debug connectivity, latency, packet loss
- Security analysis — SOC analysts review suspicious traffic, malware C2 communications
- Incident response — DFIR teams examine network dumps
- Protocol development — developers verify custom implementation conformance
- Teaching — universities use Wireshark in networking courses
Ethics and legitimate use
Wireshark is a dual-use tool: passive capture can reveal credentials if traffic is unencrypted. Legitimate use requires:
- Formal authorisation over the analysed network
- GDPR compliance if personal data is captured
- PCAP anonymisation before sharing
Wireshark making network traffic observable is a historical reason for universal HTTPS adoption — cleartext POP3/IMAP/SMTP credentials visible to everyone on the same network is a typical Wireshark demo.
In the Italian context
Wireshark is a daily work tool in Italy:
- ISPs — troubleshooting routing, peering
- Companies — network ops, security
- Universities — networking and security teaching
- CERTs and law enforcement — forensic analysis
References: Wireshark 1.0 (31 March 2008). Gerald Combs. Ethereal (1998). Rename 2006. GPL v2 licence. Libpcap/WinPcap.