7 ms·

Wireshark Is 25: The email that started it all and lessons learned along the way

348 points by ingve 3y ago

hansc 3y ago
Also fun debugging VoIP traffic to the local network, and seeing dns-queries from collegues PCs on the network, then asking them: Are you visiting xyz-webpage, and seeing their reaction!?
michaelcampbell 3y ago
I remember "Ethereal", but somehow I'd forgotten that's what turned into Wireshark.
dekhn 3y ago
One thing I really like about wireshark: there is a TUI, and there is a GUI, and both are quite usable.
quijoteuniv 3y ago
People often have this fantasy about changing the world… and then there is people that just changes the world.
drmpeg 3y ago
Back in 1983, when Ethernet was still fat coax and vampire taps, I was working at a military contractor in Silicon Valley. We had built an Ethernet bridge product that linked the DECnet LANs at DSCS (Defense Satellite Communications System) ground stations around the world (over 9600 bps encrypted circuits). As part of the code, I wrote a packet dumper that put the Ethernet card (a Multibus card from a company called Exelan) into promiscuous mode. It didn't have a dissector like Wireshark, but just being able to dump raw packets in hex to a terminal was a huge advantage for debugging networks. I love Wireshark and it's one of the first things I install on a new system.
- omginternets 3y ago
  How did Ethernet go from fat cables and vampire taps to RJ35? Is it still exactly the same protocol (is that even the right word?) as it was back then? I really need to dive deeper into networking…
  - rejectfinite 3y ago
    Study CCNA
  - gsich 3y ago
    Yes. Truly a standard ahead of its time.
  - hotpotamus 3y ago
    Every once in awhile you'll hear the odd story about someone tracking down a bottleneck in their network and finding an old 10 or 100mbps ethernet link somewhere. I doubt it happens much anymore, but your 10 gigabit gear should still be able to talk to your 10 megabit gear no problem, which I do find impressive.
    - Macha 3y ago
      More often it's that a failing cable has caused a connection to renegotiate to a lower speed than actually 10/100 equipment these days though
    - myself248 3y ago
      I've done it deliberately. I had to test a cellular device from somewhere in Asia, but I'm in the US. The Asian provider had sent us a femtocell with developer's firmware that bypassed the GPS check at startup, which would create a little bubble of their coverage in our RF test chamber, and we could put the DUT in the same chamber and do the testing. Trouble is, the femtocell wanted a network connection, and our RF chamber didn't have an RJ45 passthrough. Some emails got sent, the chamber vendor could sell us a new passthrough module but it was on backorder, ETA two months or something. So the following evening, I swung by the e-waste recycler where I used to volunteer years prior, which meant I could just give the proprietor a wave and then let myself into the back room and pick the pile. And sure enough, I found a couple of 8-port 10base-T ethernet hubs, with 10base-2 connections on the back for connection to a coax segment. I talked him up to twenty bucks so I'd have an expense to submit; the company did not deserve to get this for free. Back in the RF lab the following day, it was a trivial matter to convert the BNC connector on the hubs to the N connector in the chamber wall, locate one of the hubs inside the chamber, and connect the femtocell to it. The one outside got the internet connection, which had been running at gigabit speeds but now found itself negotiating at 10/half! (I wonder if the campus networking folks get alerts when that happens. Because it's almost surely not what's intended, unless I'm around.) The younger techs in the lab mere MYSTIFIED at this exotic hardware that could send Ethernet signals over coaxial cable! That must be expensive! How did you come up with it so fast! Whoever made that must've had this application in mind, but what a niche application! Amazing!
nabogh 3y ago
Can't say I use wireshark much day to day but it has been an incredible learning tool over the years. What a great project.
ajsnigrutin 3y ago
Wireshark is like a multimeter in electronics world.... the whole world can run without having one, but once something fails, without it, you're fucked.
- geek_at 3y ago
  wireshark and tcpdump have helped me find so many strange things in our campus network
  - nikau 3y ago
    Its even better once you learn how to run tcpdump session over ssh dumped into a pipe, and then use wireshark locally via the pipe to get a nice gui for the remote capture.
tempodox 3y ago
Happy anniversary! And thank you for all the great work.
hansc 3y ago
Such a great tool and 100% free. Use it often to debug network issues and see where devices connect to. Like someone else said: a multimeter for networks. Also used it to learn about WiFi connection setup with acces point. Can see all the beacon packets and WiFi packets
- martyvis 3y ago
  I was a very early adopter of Ethereal. My team had a Sniffer PC, but either it was being used by someone else or it didn't adequately decode protocols.
c0nsumer 3y ago
Gosh, I feel old. I remember when Ethereal was released and it got me excited. I've sure learned a ton since then thanks to it, and solved a /lot/ of problems. It really changed the world of network traffic analysis, moving network captures away from the world of special laptops and tools (needing to ask the network team to schedule and do a capture) to something that any competent tech could grab.
- nunez 3y ago
  Which is crazy because wireshark used libpcap, which does like 90% of the work of building the packets for you; the other 10% is parsing headers
  - c0nsumer 3y ago
    It's the header parsing and post-capture filtering and analysis that is the heavy lifting, though. Just like lots of things, you can collect all the data you want... But getting an actionable result is the trick. Wireshark does that.
Hikikomori 3y ago
As a network engineer I've used Wireshark weekly for most of my career, but not as much anymore as we moved to the cloud. The ISP I worked for paid for a Wireshark training [0], though I didn't learn anything new we did set up a profile that helps a lot with troubleshooting, still use it 8 years later. Wanted to learn Go so recently started working on a CLI packet capture tool like tcpdump that parses packets received on a raw socket. Got support for ethernet, ipv4, icmp, arp and udp so far. [0] https://www.bettydubois.com/ https://www.bettydubois.com/
- nunez 3y ago
  A few folks and I built one in C++ for our capstone project at Stevens Tech in 2009. Frontend was GTK. It was much slower than Wireshark, but I was surprised by how easy it was to parse the packets (for normal packets speaking the usual protocols anyway)
  - Hikikomori 3y ago
    It's a fun way to learn networking or a language as you have to do low level parsing and you have to deal with things like endianness of larger header fields. It does get tedious to write types and parsers for each protocol and you're not learning anything new after doing a few of them so I started using Chatgpt to generate code and tests for me which work surprisingly well (also paid for copilot but didn't find it very useful so far).
deleted 3y ago
[deleted]
arafalov 3y ago
This tool (Ethereal at the time) was absolutely invaluable to my job as Senior Tech Support of Weblogic family of products. I even got clients to run it and was able to provide solutions like "your large JDBC connection pool had all its connection silently dropped by a network firewall (that client was not aware of) and that's why you having 1 hour transaction delay on first one in a morning. Every pooled connection had to timeout and reset". And "Internet Explorer would abort a TCP connection for already-cached resource and that generates non-standard network level errors on your IBM server' Weblogic installation" I lost half of my hair on that job. Without Ethereal, I am sure I would have lost all of it and a lot more of my sanity too.
HankB99 3y ago
It's not something I use often, but the value of it to me is that I can "hook it up" and immediately see what's going on. The generally intuitive interface and the way it decomposes packets make it so easy to pick up and use. 25 years of effort has produced a really useful tool.
StayTrue 3y ago
Absolutely terrific software. One good memory is being stuck at a client site (20 years ago) trying to figure out an interop issue with our network equipment. In the two weeks I was there I found it helpful to write a protocol decoder plugin and it was easy work. In the end it was our bug, a bitmask applied for select() was not removed when the implementation changed to epoll() ... in essence a 1-bit memory corruption error that could have very delayed consequences. Funny what memories stand out.
- WastingMyTime89 3y ago
  I admire your ability to find joy in these things. At the beginning of my career, I once spent a week in a secure facility trying to understand an annoying network bug using tcpdump because we weren’t allowed to install wireshark. The whole thing turned out to be a combination of the worst bug I have ever seen in a standard library in our decade old version of GNAT (Ada lib - admittedly it had been corrected seven years before) and an ARP misconfiguration. The whole week was awful and largely responsible for me moving on to greener pastures. It takes a special kind of character to enjoy these things.
Roark66 3y ago
Thank you. It has been an indispensable part of my work from the very beginning. Tcpdump was fine, but being able to right on a packet and do "follow TCP stream" then see the entire conversation in a second was a game changer. Same with the "right click->filter out this stream". Also the fact ethereal/wire shark could read files saved by Tcpdump meant I could ssh onto a remote server, fire Tcpdump, run wire shark in a client and when something failed I was able to look at the network stream "from both ends". It saved me hours and hours, from dodgy ISP Nat being evident at first glance, to misconfigured MPLS networks being provable (no more the routing team could just say : it looks good for us). No, there was proof... I bet countless people continue having the same experience with this software :-) However, I have to correct one statement made in the article. Ethereal wasn't the first free gui network packet analyzer. There was a Microsoft tool I forgot the name of that was available even in Windows NT days, perhaps "netmon"? It was a long time ago. It was free and it predates ethereal. It only worked on Windows and it used it's own file format.
- dylan604 3y ago
  >It was free and it predates ethereal. It only worked on Windows so...was it really free? sounds like it came with the OS that you paid for
- muststopmyths 3y ago
  >There was a Microsoft tool I forgot the name of that was available even in Windows NT days, perhaps "netmon"? Network Monitor, also called netmon (or Bloodhound internally), which actually had a documented (maybe unsupported IIRC, but still easy to tap into) API. I wrote a tcpdump wrapper around it, before Ethereal was a thing. The API, and hence netmon, became invalid with the "next-gen" TCP stack of Longhorn/Vista. Eventually, MSNA (Microsoft Network Analyzer) came along, which worked on ETW and was able to analyze network and other ETW traces. You could write handlers for any protocol in a supported DSL. You could even make it parse log files and filter/analyze the data. The New Microsoft being what they are, they killed MSNA because it was too powerful and useful to Windows developers. It probably wasn't used by a lot of people, but if you knew how to use it it was one of the most powerful analysis tools of its time. Edit: Microsoft Message Analyzer, not Network Analyzer.
beardedwizard 3y ago
I used wireshark every day for 10+ years supporting load balancers in customer networks. Between pcaps and core dumps, it was some of the most interesting data to work with. Learning libpcap and eventually writing my own version enabled me to pivot out of tech support for the product into development. I joined as a support engineer and left as a principal software engineer writing the code I was previously supporting. Wireshark and gdb let me teach myself so much, I never had to go to college.
- Hikikomori 3y ago
  I like to call it the "I don't know what is wrong so it must be the network" problem.
wolrah 3y ago
Wireshark is the proverbial hammer that makes all networking problems look like nails. Even if there's a more specific tool available there's a good chance I can swing Wireshark at the problem and figure it out. It continues to blow my mind how many people there are in the world who consider themselves networking professionals but have never used or do not understand Wireshark. It is possibly the most important tool for actually understanding what's really happening in your network, without it you're effectively blind to so many things. Just yesterday I used it to troubleshoot a weird behavior in a recently upgraded Asterisk/FreePBX system which would have probably taken me days to guess my way through without packet captures, but with them I was able to see clearly what was happening on the network and then track that back from there. Congrats to everyone on the Wireshark team on 25 years of making network troubleshooting infinitely easier! I would 100% not be where I am today without it.
- hartator 3y ago
  Fiddle is awesome too.
  - protonbob 3y ago
    Fiddler classic is what I always go for.
- flashgordon 3y ago
  Forget something as specific and hardcore as networking. I had a week to build a nodejs poc of a legacy spring/java app/service in Amazon that was doing a bunch of service to service auth with some Tibco messaging. I couldn't find any open implementations of Tibco clients (around 2013) and the frugality leadership principle meant getting an official spec would be almost impossible. I just needed a few details of the packet structure on a couple of requests. You can guess which tool saved the day for me here! Principle Eng at the time was surprised such a tool existed!
- el_benhameen 3y ago
  Do you have any favorite sources for really understanding Wireshark? I’m not a networking professional per se, but I’m network-adjacent and I’ve dabbled in Wireshark from time to time. I can see the power, but it’s also one of those tools that’s totally overwhelming when I first approach it unless I have a very small, very specific problem. Or is it one of those tools that you learn as you need it?
krylon 3y ago
Both for learning about networks and in my work as a system and network admin, I found Wireshark (and Ethereal before that) one of the most useful tools around. I once diagnosed a networking problem a friend had by getting him to install it on his laptop and record a packet dump of his traffic, then send it to me via email.
geraldcombs 3y ago
Wireshark's creator here. Waking up to everyone's kind words and reminiscing made my morning. Thanks!
- ktm5j 3y ago
  You deserve it! You made something awesome that's been incredibly useful for a ton of people, myself included!
- iamflimflam1 3y ago
  You’ve saved my bacon on too many occasions to mention. Thank you.
- jiggawatts 3y ago
  Thanks for all the troubles shot with Wireshark over the years! Sadly, I've largely stopped using it because it appears to be unable to keep up with the data rates typically seen from servers these days. I believe the analysis is single-threaded, and doesn't seem to cache anything either. It struggles with captures "mere" gigabytes in size, which is just seconds on a 10 Gbps link.

348 points by ingve 3y ago

Also fun debugging VoIP traffic to the local network, and seeing dns-queries from collegues PCs on the network, then asking them: Are you visiting xyz-webpage, and seeing their reaction!?

michaelcampbell 3y ago

I remember "Ethereal", but somehow I'd forgotten that's what turned into Wireshark.

dekhn 3y ago

One thing I really like about wireshark: there is a TUI, and there is a GUI, and both are quite usable.

quijoteuniv 3y ago

People often have this fantasy about changing the world… and then there is people that just changes the world.

drmpeg 3y ago

Back in 1983, when Ethernet was still fat coax and vampire taps, I was working at a military contractor in Silicon Valley. We had built an Ethernet bridge product that linked the DECnet LANs at DSCS (Defense Satellite Communications System) ground stations around the world (over 9600 bps encrypted circuits). As part of the code, I wrote a packet dumper that put the Ethernet card (a Multibus card from a company called Exelan) into promiscuous mode. It didn't have a dissector like Wireshark, but just being able to dump raw packets in hex to a terminal was a huge advantage for debugging networks. I love Wireshark and it's one of the first things I install on a new system.

omginternets 3y ago
How did Ethernet go from fat cables and vampire taps to RJ35? Is it still exactly the same protocol (is that even the right word?) as it was back then? I really need to dive deeper into networking…
- rejectfinite 3y ago
  Study CCNA
- gsich 3y ago
  Yes. Truly a standard ahead of its time.
- hotpotamus 3y ago
  Every once in awhile you'll hear the odd story about someone tracking down a bottleneck in their network and finding an old 10 or 100mbps ethernet link somewhere. I doubt it happens much anymore, but your 10 gigabit gear should still be able to talk to your 10 megabit gear no problem, which I do find impressive.
  - Macha 3y ago
    More often it's that a failing cable has caused a connection to renegotiate to a lower speed than actually 10/100 equipment these days though
  - myself248 3y ago
    I've done it deliberately. I had to test a cellular device from somewhere in Asia, but I'm in the US. The Asian provider had sent us a femtocell with developer's firmware that bypassed the GPS check at startup, which would create a little bubble of their coverage in our RF test chamber, and we could put the DUT in the same chamber and do the testing. Trouble is, the femtocell wanted a network connection, and our RF chamber didn't have an RJ45 passthrough. Some emails got sent, the chamber vendor could sell us a new passthrough module but it was on backorder, ETA two months or something. So the following evening, I swung by the e-waste recycler where I used to volunteer years prior, which meant I could just give the proprietor a wave and then let myself into the back room and pick the pile. And sure enough, I found a couple of 8-port 10base-T ethernet hubs, with 10base-2 connections on the back for connection to a coax segment. I talked him up to twenty bucks so I'd have an expense to submit; the company did not deserve to get this for free. Back in the RF lab the following day, it was a trivial matter to convert the BNC connector on the hubs to the N connector in the chamber wall, locate one of the hubs inside the chamber, and connect the femtocell to it. The one outside got the internet connection, which had been running at gigabit speeds but now found itself negotiating at 10/half! (I wonder if the campus networking folks get alerts when that happens. Because it's almost surely not what's intended, unless I'm around.) The younger techs in the lab mere MYSTIFIED at this exotic hardware that could send Ethernet signals over coaxial cable! That must be expensive! How did you come up with it so fast! Whoever made that must've had this application in mind, but what a niche application! Amazing!

nabogh 3y ago

Can't say I use wireshark much day to day but it has been an incredible learning tool over the years. What a great project.

ajsnigrutin 3y ago

Wireshark is like a multimeter in electronics world.... the whole world can run without having one, but once something fails, without it, you're fucked.

geek_at 3y ago
wireshark and tcpdump have helped me find so many strange things in our campus network
- nikau 3y ago
  Its even better once you learn how to run tcpdump session over ssh dumped into a pipe, and then use wireshark locally via the pipe to get a nice gui for the remote capture.

tempodox 3y ago

Happy anniversary! And thank you for all the great work.

hansc 3y ago

Such a great tool and 100% free. Use it often to debug network issues and see where devices connect to. Like someone else said: a multimeter for networks. Also used it to learn about WiFi connection setup with acces point. Can see all the beacon packets and WiFi packets

martyvis 3y ago
I was a very early adopter of Ethereal. My team had a Sniffer PC, but either it was being used by someone else or it didn't adequately decode protocols.

c0nsumer 3y ago

Gosh, I feel old. I remember when Ethereal was released and it got me excited. I've sure learned a ton since then thanks to it, and solved a /lot/ of problems. It really changed the world of network traffic analysis, moving network captures away from the world of special laptops and tools (needing to ask the network team to schedule and do a capture) to something that any competent tech could grab.

nunez 3y ago
Which is crazy because wireshark used libpcap, which does like 90% of the work of building the packets for you; the other 10% is parsing headers
- c0nsumer 3y ago
  It's the header parsing and post-capture filtering and analysis that is the heavy lifting, though. Just like lots of things, you can collect all the data you want... But getting an actionable result is the trick. Wireshark does that.

Hikikomori 3y ago

As a network engineer I've used Wireshark weekly for most of my career, but not as much anymore as we moved to the cloud. The ISP I worked for paid for a Wireshark training [0], though I didn't learn anything new we did set up a profile that helps a lot with troubleshooting, still use it 8 years later. Wanted to learn Go so recently started working on a CLI packet capture tool like tcpdump that parses packets received on a raw socket. Got support for ethernet, ipv4, icmp, arp and udp so far. [0] https://www.bettydubois.com/ https://www.bettydubois.com/

nunez 3y ago
A few folks and I built one in C++ for our capstone project at Stevens Tech in 2009. Frontend was GTK. It was much slower than Wireshark, but I was surprised by how easy it was to parse the packets (for normal packets speaking the usual protocols anyway)
- Hikikomori 3y ago
  It's a fun way to learn networking or a language as you have to do low level parsing and you have to deal with things like endianness of larger header fields. It does get tedious to write types and parsers for each protocol and you're not learning anything new after doing a few of them so I started using Chatgpt to generate code and tests for me which work surprisingly well (also paid for copilot but didn't find it very useful so far).

deleted 3y ago

[deleted]

arafalov 3y ago

This tool (Ethereal at the time) was absolutely invaluable to my job as Senior Tech Support of Weblogic family of products. I even got clients to run it and was able to provide solutions like "your large JDBC connection pool had all its connection silently dropped by a network firewall (that client was not aware of) and that's why you having 1 hour transaction delay on first one in a morning. Every pooled connection had to timeout and reset". And "Internet Explorer would abort a TCP connection for already-cached resource and that generates non-standard network level errors on your IBM server' Weblogic installation" I lost half of my hair on that job. Without Ethereal, I am sure I would have lost all of it and a lot more of my sanity too.

HankB99 3y ago

It's not something I use often, but the value of it to me is that I can "hook it up" and immediately see what's going on. The generally intuitive interface and the way it decomposes packets make it so easy to pick up and use. 25 years of effort has produced a really useful tool.

StayTrue 3y ago

Absolutely terrific software. One good memory is being stuck at a client site (20 years ago) trying to figure out an interop issue with our network equipment. In the two weeks I was there I found it helpful to write a protocol decoder plugin and it was easy work. In the end it was our bug, a bitmask applied for select() was not removed when the implementation changed to epoll() ... in essence a 1-bit memory corruption error that could have very delayed consequences. Funny what memories stand out.

WastingMyTime89 3y ago
I admire your ability to find joy in these things. At the beginning of my career, I once spent a week in a secure facility trying to understand an annoying network bug using tcpdump because we weren’t allowed to install wireshark. The whole thing turned out to be a combination of the worst bug I have ever seen in a standard library in our decade old version of GNAT (Ada lib - admittedly it had been corrected seven years before) and an ARP misconfiguration. The whole week was awful and largely responsible for me moving on to greener pastures. It takes a special kind of character to enjoy these things.

Roark66 3y ago

Thank you. It has been an indispensable part of my work from the very beginning. Tcpdump was fine, but being able to right on a packet and do "follow TCP stream" then see the entire conversation in a second was a game changer. Same with the "right click->filter out this stream". Also the fact ethereal/wire shark could read files saved by Tcpdump meant I could ssh onto a remote server, fire Tcpdump, run wire shark in a client and when something failed I was able to look at the network stream "from both ends". It saved me hours and hours, from dodgy ISP Nat being evident at first glance, to misconfigured MPLS networks being provable (no more the routing team could just say : it looks good for us). No, there was proof... I bet countless people continue having the same experience with this software :-) However, I have to correct one statement made in the article. Ethereal wasn't the first free gui network packet analyzer. There was a Microsoft tool I forgot the name of that was available even in Windows NT days, perhaps "netmon"? It was a long time ago. It was free and it predates ethereal. It only worked on Windows and it used it's own file format.

dylan604 3y ago
>It was free and it predates ethereal. It only worked on Windows so...was it really free? sounds like it came with the OS that you paid for
muststopmyths 3y ago
>There was a Microsoft tool I forgot the name of that was available even in Windows NT days, perhaps "netmon"? Network Monitor, also called netmon (or Bloodhound internally), which actually had a documented (maybe unsupported IIRC, but still easy to tap into) API. I wrote a tcpdump wrapper around it, before Ethereal was a thing. The API, and hence netmon, became invalid with the "next-gen" TCP stack of Longhorn/Vista. Eventually, MSNA (Microsoft Network Analyzer) came along, which worked on ETW and was able to analyze network and other ETW traces. You could write handlers for any protocol in a supported DSL. You could even make it parse log files and filter/analyze the data. The New Microsoft being what they are, they killed MSNA because it was too powerful and useful to Windows developers. It probably wasn't used by a lot of people, but if you knew how to use it it was one of the most powerful analysis tools of its time. Edit: Microsoft Message Analyzer, not Network Analyzer.

beardedwizard 3y ago

I used wireshark every day for 10+ years supporting load balancers in customer networks. Between pcaps and core dumps, it was some of the most interesting data to work with. Learning libpcap and eventually writing my own version enabled me to pivot out of tech support for the product into development. I joined as a support engineer and left as a principal software engineer writing the code I was previously supporting. Wireshark and gdb let me teach myself so much, I never had to go to college.

Hikikomori 3y ago
I like to call it the "I don't know what is wrong so it must be the network" problem.

wolrah 3y ago

Wireshark is the proverbial hammer that makes all networking problems look like nails. Even if there's a more specific tool available there's a good chance I can swing Wireshark at the problem and figure it out. It continues to blow my mind how many people there are in the world who consider themselves networking professionals but have never used or do not understand Wireshark. It is possibly the most important tool for actually understanding what's really happening in your network, without it you're effectively blind to so many things. Just yesterday I used it to troubleshoot a weird behavior in a recently upgraded Asterisk/FreePBX system which would have probably taken me days to guess my way through without packet captures, but with them I was able to see clearly what was happening on the network and then track that back from there. Congrats to everyone on the Wireshark team on 25 years of making network troubleshooting infinitely easier! I would 100% not be where I am today without it.

hartator 3y ago
Fiddle is awesome too.
- protonbob 3y ago
  Fiddler classic is what I always go for.
flashgordon 3y ago
Forget something as specific and hardcore as networking. I had a week to build a nodejs poc of a legacy spring/java app/service in Amazon that was doing a bunch of service to service auth with some Tibco messaging. I couldn't find any open implementations of Tibco clients (around 2013) and the frugality leadership principle meant getting an official spec would be almost impossible. I just needed a few details of the packet structure on a couple of requests. You can guess which tool saved the day for me here! Principle Eng at the time was surprised such a tool existed!
el_benhameen 3y ago
Do you have any favorite sources for really understanding Wireshark? I’m not a networking professional per se, but I’m network-adjacent and I’ve dabbled in Wireshark from time to time. I can see the power, but it’s also one of those tools that’s totally overwhelming when I first approach it unless I have a very small, very specific problem. Or is it one of those tools that you learn as you need it?

krylon 3y ago

Both for learning about networks and in my work as a system and network admin, I found Wireshark (and Ethereal before that) one of the most useful tools around. I once diagnosed a networking problem a friend had by getting him to install it on his laptop and record a packet dump of his traffic, then send it to me via email.

geraldcombs 3y ago

Wireshark's creator here. Waking up to everyone's kind words and reminiscing made my morning. Thanks!

ktm5j 3y ago
You deserve it! You made something awesome that's been incredibly useful for a ton of people, myself included!
iamflimflam1 3y ago
You’ve saved my bacon on too many occasions to mention. Thank you.
jiggawatts 3y ago
Thanks for all the troubles shot with Wireshark over the years! Sadly, I've largely stopped using it because it appears to be unable to keep up with the data rates typically seen from servers these days. I believe the analysis is single-threaded, and doesn't seem to cache anything either. It struggles with captures "mere" gigabytes in size, which is just seconds on a 10 Gbps link.