Typically a network administrator will use Wireshark to troubleshoot network problems, the network security engineers use it to examine security problems, developers use it to debug protocol implementations and students may use it to learn network protocol internals.

Wireshark is able to inspect hundreds of protocols, with more being added all the time. It lets you interactively browse packet data from a live network or from a previously saved capture file. Packets captured are displayed with very detailed protocol information.

Wireshark’s native capture file format is libpcap format, which is also the format used by tcpdump and various other tools.

Like other protocol analyzers, Wireshark’s main window shows 3 views of a packet. It shows a summary line, briefly describing what the packet is. The second view is showing packet details which allows user to drill down to exact protocol or field. Finally, a hex dump shows the user exactly what the packet looks like when it goes over the wire. Coloring rules can be applied to the packet list for quick, intuitive analysis. Below is an example of Wireshark’s main window after packets have been captured.

Live data can be read from devices such as Ethernet, Token Ring, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Frame Relay, FDDI, and others.

Wireshark is also having the decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2.

The output of Wireshark can be exported to XML, PostScript, CSV, or plain text.

Wireshark is available in all major modern operating systems like Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others. Installation process for Wireshark is fairly simple. For Windows system, you will need to install WinPcap capture driver (it is built into the Wireshark installation package) together with Wireshark as packet capturing in Wireshark is performed with the pcap library. WinPcap interacts with Windows OS to capture raw packet data, apply filters, and switch the network interface in and out of promiscuous mode.

You may download Wireshark from the official Wireshark web page.

It is quite easy to change the PC network adapter MAC address, simply select the PC network adapter, type the new MAC or delete the current one and enable it. You can use a new physical address of your choice, Randomly generate an address, or get a new one with the help of this tool – you can select the OID part according to your prefer Manufacturer. For example, if you select the address from Cisco, it would be something like: 00059b123456.

This is a tool that is very helpful if you like to test if the firewall or proxy is filtering network access through the MAC address. Even though your network adapter do not has the option to change the MAC address as in its property, you can use this tool to perform this network changes for you.

By the way, addresses changes are permanent until you decide to remove the new address.