This wiki has been migrated to and is now deprecated. Please use that site instead.


This is a place for scripts and tools related to Wireshark / TShark that users may like to share, and for links to related NetworkTroubleshooting tools.

You will find additional development related tools in the Development page.


Some command line tools are shipped together with Wireshark. These tools are useful to work with capture files.



Tools related to NetworkTroubleshooting and alike.

Dedicated capture tools

Monitoring/tracing tools

The following tools can process the libpcap-format files that Wireshark and TShark produce or can perform network traffic capture and analysis functions complementary to those performed by Wireshark and TShark. In brackets you will find the program license and the supported operating systems.

Traffic generators

These tools will either generate traffic and transmit it, retransmit traffic from a capture file, perhaps with changes, or permit you to edit traffic in a capture file and retransmit it.

This is another collection of traffic generators:

Capture file editors and/or anonymizers

These tools can be used to "anonymize" capture files, replacing fields such as IP addresses with randomized values.

There's a categorized list of anonymization tools at the CAIDA site.

Capture file repair

These tools attempt to repair damaged capture files as much as can be done.

Capture file tools

Capture file conversion

These tools convert between different capture file formats.


USB capture

Currently, raw USB traffic can be captured with Wireshark only under Linux, macOS, and Windows; see CaptureSetup/USB. If it's an Ethernet (or any other network related) USB adapter, Wireshark can capture e.g. Ethernet traffic from that USB device if the platform supports it (which it usually will do). On Win32 you can however try:

Intrusion Analysis / SQL Database Support

Tools (last edited 2020-07-14 14:48:02 by ChristopherMaynard)