Free and open-source network packet analyzer software Wireshark is getting its own open source foundation. Wireshark allows to capture and analyse network traffic in real-time and provide information on network protocols, packet structure, and network performance. Wireshark foundation, a non-profit, aims to help and grow their community. The foundation will also host “Sharkfest” developer convention to promote analysis and troubleshooting education. Presumably, by making it an open-source foundation, companies cannot acquire the product, thereby preventing future players from controlling it. 

Origin

Wireshark was started in 1998 as ‘Ethereal’ and was rebranded in 2006. The software has been available as open source from its inception. The corporate sponsorship of the project has been changing with the founder Gerald Combs’ transition into different jobs. Combs was working with CACE Technologies in 2010 which was the lead sponsor until it was acquired by Riverbed in 2010. In 2021, with Combs’ movement to Sysdig, the company became the lead sponsor for several years. 

The tool supports various functions and users such as network administrators, security analysts and developers. It runs on different platforms such as Windows, MacOS and Linux. The technology also supports different types of connections such as wired Ethernet, Wi-Fi, Bluetooth, and other networking protocols. Wireshark takes low level, network-based packet information and translates it into an interpretable format for users. There are over five million lines of code in Wireshark. 

Applications and Growth

The applications of Wireshark are plenty. It can be used to identify network problems such as slow response times, dropped packets and connectivity issues. These functions aid network administrators in taking corrective action. One of the most important applications of Wireshark is in cybersecurity. Security breaches such as network intrusions, malware infections and data exfiltration can be detected. By providing a detailed view of network traffic, investigators can detect the source of malware infection and take necessary steps. The drawback to Wireshark is that it cannot run from outside a network. Packet injection is not possible and it cannot capture a passing packet stream to be substituted with new ones. 

Wireshark has existed for a long time; the company will celebrate its 25th year of existence in July of this year. With ‘Wireshark Foundation’ being set up, the support and contributions to the project will grow and will further help promote the technology.