When I need to create an IPS rule, I need to check the traffic deeply to get more insights about the actual traffic, what's the name of certain flags, etc., and I'm able to do all that through Wireshark. Its best feature is that it allows me to deeply understand what's going on at the packet level, as well as any adverse signatures that I can analyze. You will have to do some digging only if you have a very specific use case.' 'I find Wireshark a very useful tool. If you have any trouble, it is pretty easy to find an answer online. There is a lot of information out there on Google and YouTube about how to use it. It also gives you more visibility into your network. It allows you to see the network activity of the users you are investigating. Such a feature is pretty helpful for an ongoing forensic investigation or when there is a potential insider threat that you are trying to investigate. 'Being able to dissect email data and figure out what is inside email messages was the most valuable feature.

Wireshark http vs https