1. Home
  2. Packet Analyzer Tools
  3. Wireshark Reviews
  4. User Review of Wireshark
Wireshark - Perfect Tool for Network Admins
March 03, 2018

Wireshark - Perfect Tool for Network Admins

Matthew Frederickson | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User

Overall Satisfaction with Wireshark

We use Wireshark to troubleshoot network problems - both wired and wireless. It's not uncommon to get a ticket from a user stating that the network is "slow". Since that is always less then helpful, we usually (after basic troubleshooting steps) start a Wireshark capture closest tot he endpoint with the issue. Invariably, we are always able to find the issue - whether it's endpoint or switch related - or even if it's something downstream. We've managed to train some of the IT staff in how to do a capture - so even if they don't understand what they are looking at, they are familiar with grapping a pcap file for our review.
  • Displays data (network captures) in a logical, clear way that enables you to easily see what is happening on the wire.
  • Provides expert help and color codes packet types so it's easy to quickly pick out different types of traffic.
  • Separates the data into three panes so you can get an overview, packet details, and see string data.
  • Can be a little intimidating right out of the box.
  • Saves money by allowing me to see what's going on and gives me the ability to fix the issues myself. Otherwise, I would need to hire a consultant.
  • You would not expect a carpenter to build a house without a hammer. He has other tools that he uses, but the hammer is an important one. Well, Wireshark is like that for anyone responsible for maintaining or managing a network. It's one tool - one very important tool.
I'm not sure there are other products out there that can do all that Wireshark does for the price (free). Yes, there are commercial products that can do "more", but I haven't found the need to do anything "more" that I need to spend money on. It can generate reports; export data so you can generate your own graphs and reports; and allows you to perform baseline analysis on your network segments.
Wireshark is awesome for troubleshooting network issues. It gives you a direct view into what is happening on the wire. It takes the guesswork out of knowing what is happening on the wire - you can tell whether there are delays from web sites; file servers; voice issues. Yes - it is great for troubleshooting SIP traffic also.

It does not do massive file captures; it does not do a good job on massive packet capture files. If you are capturing traffic on a ten-gig or higher port, use tcpdump or some other mechanism to grab the data. Then use tshark (or one of the other included tools) to parse out what you need (time range, or specific type of traffic) to analyze inside wireshark.