Wireshark
Wireshark captures and examines network traffic to help people investigate connection problems and security issues. It’s made by Wireshark Foundation, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from wireshark.org.
What it is
Wireshark is a free, open-source tool used by network technicians, security specialists, developers and students. It records network traffic and lets people examine individual messages or open previously saved captures.
On a Mac, capturing traffic requires its ChmodBPF helper, which grants access to the system’s packet capture devices. Captures can contain sensitive information, including passwords. What it can see depends on the network connection and capture setup.
Wireshark is an established troubleshooting tool. Official Mac packages are signed by Wireshark Foundation. Its security advisories document flaws triggered by specially made network traffic, capture files or configuration profiles, so updates matter.
Who makes it
Wireshark Foundation is a US nonprofit announced in 2023 that supports Wireshark development and network analysis education. Its website is wiresharkfoundation.org.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Wireshark. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.wireshark.Wireshark. Download it only from wireshark.org, not from an ad or a link someone sends you.
Fakes. In August 2010, criminals used the name “Wireshark Antivirus” for Windows malware that displayed false infection warnings and demanded payment. The Wireshark team warned that it had never made antivirus software.
What it connects to
In normal use, Wireshark talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
www.wireshark.org | Checks for software updates. |
Security record
Problems with Wireshark or Wireshark Foundation in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Importing a specially made configuration profile could crash Wireshark or run an attacker’s code; fixed in versions 4.6.9 and 4.4.19. | ↗ | |
| Specially made RDP network traffic or capture files could crash Wireshark; fixed in versions 4.6.8 and 4.4.18. | ↗ | |
| Opening a specially made BLF capture file could reveal sensitive information from memory; fixed in versions 4.6.7 and 4.4.17. | ↗ | |
| Specially made ROHC network traffic or capture files could crash Wireshark; fixed in versions 4.6.6 and 4.4.16. | ↗ | |
| Specially made TLS network traffic or capture files could crash Wireshark and potentially run an attacker’s code; fixed in version 4.6.5. | ↗ |
References
- Wireshark macOS application property list raw.githubusercontent.com
- Announcing the Wireshark Foundation wireshark.org
- Wireshark Foundation wiresharkfoundation.org
- Wireshark Foundation privacy policy and business address wiresharkfoundation.org
- Wireshark frequently asked questions wireshark.org
- Installing Wireshark under macOS wireshark.org
- Capture privileges wiki.wireshark.org
- Download Wireshark wireshark.org
- Updating Wireshark wireshark.org
- Wireshark release notes wireshark.org
- Wireshark Antivirus malware warning wireshark.org
- Microsoft Security Intelligence: WiresharkAntivirus microsoft.com
- Profile import crash and possible code execution wireshark.org
- RDP protocol dissector crash wireshark.org
- BLF file parser information disclosure wireshark.org
- ROHC protocol dissector crash wireshark.org
- TLS dissector crash and possible code execution wireshark.org