There are many alternatives to Wireshark for Linux if you are looking for a replacement. The best open source Linux alternative is tcpdump. If that doesn't suit you, our users have ranked more than 50 alternatives to Wireshark and many of them are open source and available for Linux so hopefully you can find a suitable replacement. Other interesting open source Linux alternatives to Wireshark are NetworkMiner, Ettercap, Termshark and Scapy.
Command-line packet analyzer for monitoring, capturing, and filtering network traffic in real time. Supports TCP/IP protocols, pcap file export, BPF syntax, timestamped outputs, and works on UNIX-like systems with both wired and wireless interfaces.
NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can extract transmitted files and certificates from PCAP files containing HTTP, FTP, SMB, SMB2, TFTP and several other protocols.
Sweden
EU
Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks.
If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help!
Sysdig is open source, system-level exploration: capture system state and activity from a running Linux instance, then save, filter and analyze. Think of it as strace + tcpdump + lsof + awesome sauce.
NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process.
NetherlandsEU
tcpflow, a TCP Flow Recorder, is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but...
httpry is a tool designed for displaying and logging HTTP traffic. It is not intended to perform analysis itself, but instead to capture, parse and/or log the traffic for later analysis. It can be run in real-time displaying the live traffic on the wire, or as a daemon process...
Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.
PlayCap plays back captures made from Wireshark, tcpdump, WinDump, or any libpcap-based application. PlayCap was originally (and still is) a part of IG Scanner by Signal 11 Software, but was spun off as a separate app and released as Open Source software.
United States
