In May 2006, Combs accepted a job with CACE Technologies. The Ethereal trademark is owned by Network Integration Services. The commercial protocol analysis products at the time were priced around $1500 and did not run on the company's primary platforms (Solaris and Linux), so Gerald began writing Ethereal and released the first version around 1998. In the late 1990s, Gerald Combs, a computer science graduate of the University of Missouri–Kansas City, was working for a small Internet service provider. If a remote machine captures packets and sends the captured packets to a machine running Wireshark using the TZSP protocol or the protocol used by OmniPeek, Wireshark dissects those packets, so it can analyze packets captured on a remote machine at the time that they are captured. On Linux, BSD, and OS X, with libpcap 1.0.0 or later, Wireshark 1.4 and later can also put wireless network interface controllers into monitor mode. Simple passive taps are extremely resistant to tampering.

Port mirroring or various network taps extend capture to any point on the network. However, when capturing with a packet analyzer in promiscuous mode on a port on a network switch, not all traffic through the switch is necessarily sent to the port where the capture is done, so capturing in promiscuous mode is not necessarily sufficient to see all network traffic. Wireshark lets the user put network interface controllers that support promiscuous mode into that mode, so they can see all traffic visible on that interface, not just traffic addressed to one of the interface's configured addresses and broadcast/multicast traffic. Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options. Wireshark, and the other programs distributed with it such as TShark, are free software, released under the terms of the GNU General Public License. There is also a terminal-based (non-GUI) version called TShark. Wireshark is cross-platform, using the GTK+ widget toolkit in current releases, and Qt in the development version, to implement its user interface, and using pcap to capture packets it runs on Linux, OS X, BSD, Solaris, some other Unix-like operating systems, and Microsoft Windows.

Originally named Ethereal, the project was renamed Wireshark in May 2006 due to trademark issues. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is a free and open-source packet analyzer.

Wireshark open source