What is Wireshark, and what does it show about the traffic it captures?

A free, open-source packet analyser. It captures every packet entering or leaving a network interface (through the pcap library) and decodes each one layer by layer: addresses, ports, protocol fields and, for unencrypted traffic, the payload itself.

Wireshark runs on Linux, macOS and Windows and is the standard tool for network troubleshooting and protocol analysis. For each packet it shows:

• a summary line: time, source and destination IP address, protocol, length and a short description;
• the decoded layers: Ethernet or 802.11 frame, IP header, TCP or UDP header, then the application protocol (HTTP, MQTT, CoAP, DNS and hundreds more);
• the raw bytes in hex and ASCII.

Two features make it practical on a busy network. Display filters narrow thousands of packets to the ones you care about (ip.addr == 192.168.1.50, http.request.method == "POST", mqtt). Follow stream reassembles one TCP conversation into readable text, so a whole HTTP request and response can be read at once.

For security work the lesson is direct: whatever is sent without encryption is readable in full, including commands, passwords and tokens. If a device's traffic makes sense in Wireshark, an attacker on the same network can read it too.

Go deeper:

• Wireshark — the download and documentation.
• Wireshark wiki — Display filters — filter syntax with common examples.
• Wikipedia — Wireshark — history, features and how capture works.