Wireshark is a world-class network protocol analyzer application. It captures live traffic or reads saved capture files (pcap, pcapng, etc.) and dissects them into a structured, hierarchical view of hundreds of network protocols. The application is built on a modular architecture: `libwsutil` (utilities), `libwiretap` (capture file I/O), and `libwireshark` (dissection engine). It provides a rich Qt-based graphical user interface (Wireshark) and a powerful command-line interface (TShark). Key features include a custom domain-specific language for display filtering (with its own compiler and virtual machine), a Lua scripting API for extensibility, a plugin system for protocol dissectors, and support for decrypting various protocols (TLS, IPsec, 802.11). The codebase is exceptionally well-engineered, with clean abstractions and highly reusable components like its scope-based memory manager (`wmem`) and its file format abstraction layer (`wiretap`). It is under very active maintenance and is the de-facto standard tool for network analysis.