Wireshark

When a network misbehaves, most troubleshooting is guesswork: can it ping, is it DNS, is a firewall blocking it. Wireshark removes the guessing — it lays out every byte actually sent and received on the interface, decoding Ethernet frames, IP headers, TCP segments and application protocols layer by layer into readable structures.

It has been the standard tool in this field for over two decades. GPL-2.0, with protocol support in the thousands.

Real uses:

• Diagnosing connections: which step of the TCP handshake failed, whether there are retransmissions, who sent the RST, where the TLS handshake broke — all visible in the packets.
• Analyzing application behavior: exactly which servers a program contacts at startup and what it sends. This is the most direct way to verify whether an app is quietly transmitting data.
• Learning protocols. Three-way handshakes, sliding windows and DNS resolution appear as they actually happen, which is why many networking courses teach with it.
• Performance analysis through TCP stream graphs, throughput curves and round-trip time distributions.

Practical features include powerful display filters (http.request.method == "POST" and the like), "follow stream" to reassemble an entire TCP conversation, protocol statistics, expert hints that flag anomalies, and export in many formats.

The boundaries and responsibilities must be stated:

• Only capture traffic you are entitled to analyze. Your own machine's interface, servers you administer and your own lab network are fine. Intercepting other people's communications on public Wi-Fi or someone else's network is illegal and criminal in many jurisdictions. The tool is entirely lawful; its use is your responsibility.
• Capturing requires administrative privileges to put the interface in promiscuous mode. On Linux, follow the official guidance to grant dumpcap the necessary capability rather than running the whole application as root.
• Encrypted contents stay hidden. HTTPS payloads are encrypted, leaving only the handshake and metadata — who connected to whom, when and how many bytes. Reading HTTPS plaintext is mitmproxy's job, and requires installing a certificate on the device.
• Switched networks limit what you see. Modern switches deliver frames only to the destination port, so on your own machine you generally see only your own traffic — which is a good thing.
• There is a learning curve. The first launch is a waterfall of scrolling packets. Learn the filters first — something like ip.addr == <address> — to remove the noise before any analysis is possible.

For network administrators, backend developers, security researchers and networking students, this is essential.