Wireshark Blog
blog.wireshark.org · Company blog · on HN since 2013
The Wireshark project's official blog covers releases, history, the move to Qt, and network analysis tooling.
What HN saysHN commenters link it for how to run Wireshark without root, the GTK to Qt change, and the T-Mobile use of UK MoD address space.
17HN people shared it
9linked it in comments
8stories submitted
326story points
2 years agolast shared
2013people per year2026
Most-shared posts
- 1T mobile clever or insane5 people · first shared 2014
- 2Wireshark is switching to Qt2 people · 277 points · first shared 2013 · 135 comments on HN
- 3Let me tell you about Wireshark 2.02 people · 38 points · first shared 2015 · discussion on HN
- 4Wireshark Is 25: The email that started it all and lessons learned along the way1 people · 4 points · first shared 2023 · discussion on HN
- 5From Network Packets to Log Data: How Logray Built Upon Falco's Foundation1 people · 2 points · first shared 2024 · discussion on HN
- 6Wireshark Is Now Twenty1 people · 2 points · first shared 2018 · discussion on HN
- 7The evolution of system introspection from BPF to Wireshark to Falco1 people · 2 points · first shared 2023 · 1 comments on HN
- 8Announcing the Wireshark Foundation1 people · 1 points · first shared 2023 · discussion on HN
- 9To infinity and beyond capturing forever with tshark1 people · first shared 2022
- 10Osx x11.png1 people · first shared 2020
- 11Running wireshark as you1 people · first shared 2025
What HN people wrote when they linked it
wutwutwat · 2025-02-03
Did everyone forget about wireshark, which can totally be ran as non-root?
https://blog.wireshark.org/2010/02/running-wireshark-as-you/
mmh0000 · 2022-05-02
tshark[0][1] has been the go-to standard for CLI packet analysis for a long time. It'd be really nice if Gosniff provided some kind of documentation on how it differentiates itself from tshark.
[0] https://tshark.dev/
[1] https://blog.wireshark.org/2014/07/to-infinity-and-beyond-capturing-fo…
nneonneo · 2021-03-04
The “US DoD” IP could simply be a mobile network operator’s internal IP address leaking via the XFF header. Mobile network operators are known to use public but unadvertised IP ranges such as 25.0.0.0/8 (UK MoD: https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/) for their internal networks in order to avoid clashes with actual private IPs. For example, by using a “public” IP address, any private IP address requests from a client will route through e.g. WiFi instead of through the cell network. It would not surprise me if a Chinese mobile network operator was using chunks of unadvertised US DoD IP address for the same purpose.
jcelerier · 2020-03-22
> Does this mean GTK2 and GTK3 are... to be avoided for new projects / dead?
not dead but... here's for instance how Wireshark looked on macOS when it was using GTK :
https://blog.wireshark.org/wp-content/uploads/2013/10/osx-x11.png
and here's how it looks now that it is using Qt :
https://news-cdn.softpedia.com/images/news2/wireshark-3-0-released-as-…
netopexcept · 2018-11-09
I'm sure TMobile is intimately familiar with their networking assets. They pioneered squatting on MoD space for internal routing to avoid dual homed conflicts. (25.0.0.0/8)
https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/
simion314 · 2018-11-03
Making simple apps is simple, probably is much harder to do advanced apps
Wireshark changed from GTK to Qt
https://blog.wireshark.org/2013/10/switching-to-qt/
Linus Torwald, a C fan and c++ hater , decided to port from GTK to Qt https://www.youtube.com/watch?v=ON0A1dsQOV0
If you make a simple GUI like for a python script GTK is enough
opless · 2015-01-29
https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/
(amongst others)
Basically some ISPs are 'reclaiming' unused/unadvertised IP addresses that are used by Gov Agencies (Military and Security Services) to use on their internal networks.
Nothing will break (at the moment) because those networks are not accessible from the internet, and also not routed anywhere, despite being allocated.
runlevel1 · 2014-04-23
For instance, T-Mobile is using the UK Ministry of Defense's 25.0.0.0/8 allocation to extend their private network address space.[1]
[1]: https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/