Wireshark

Wireshark is a widely-used network sniffer that captures packets off the wire and dissects numerous protocols. The main graphical tool 'wireshark' allows interactive analysis, while 'tshark' provides console-based packet dumping and filtering. Additional utilities like dumpcap for capturing, capinfos for file information, and editcap for editing capture files extend its functionality.

Common use cases include network troubleshooting, protocol analysis, security monitoring, and forensic investigation of network traffic. It supports reading and writing various capture file formats through libwiretap and provides deep packet inspection via libwireshark.

The Kali package provides multiple components including stratoshark for system call analysis, captype for file type identification, and mergecap for combining captures. Development libraries enable custom dissector creation.

Wireshark uses libpcap for packet capture and libwireshark for protocol dissection. Libwiretap handles multiple capture formats like pcap, Sniffer, and snoop. Packets are filtered using BPF syntax during capture or Wireshark display filter syntax during analysis. Tshark and graphical tools process captures in one or two passes, applying read and display filters. Utility libraries like libwsutil provide supporting functions for name resolution, decompression, and utilities.