Data can be captured 'off the wire' from a live network connection, or read from a capture file.Any of these files can be compressed with gzip and Wireshark will decompress them on the fly.

Wireshark can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers. The program,can read capture files from tcpdump (libpcap), NAI Sniffer (compressed and uncompressed), Sniffer Pro, NetXray, snoop, Shomiti Surveyor, AIX s iptrace, Microsoft Network Monitor, Novell s LANalyzer, RADCOM s WAN/LAN Analyzer, HP-UX nettl, ISDN4BSD, Cisco Secure IDS iplog, the pppd log (pppdump-format), and the AG Group s/Wildpacket Etherpeek. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. You can interactively browse the capture data and view summary and detail information for each packet. Wireshark is a network protocol analyzer that enables you to capture and examine data from a live network or from a capture file on disk.

Wireshark protocol filter 1