This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is it illegal to use tshark?

0

I don't want legal advice, I'm just asking this question academically: Is it illegal to use wireshark/tshark in monitor mode to resolve signal strengths and mac addresses on a network that is yours or otherwise?

Section 18 U.S. Code § 2511 says it is illegal to

intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication

There are exceptions if it is being used for personal cybersecurity or consent is given.

However, I guess my question is more specifically related to whether resolving the mac addresses and signal strengths counts as "interception of electronic communication"?

asked 14 May '17, 09:16

qrv3w's gravatar image

qrv3w
11112
accept rate: 0%

Your asking legal advice...

(14 May '17, 23:34) Jaap ♦

It is perfectly fine to talk about law without it being legal advice. Here, I am not asking for legal advice because I'm asking for an interpretation of law as a hypothetical example for my own academic purposes. There is no particular factual situation I am asking about. I have no obligations or responsibilities that will change upon receiving any information about this question. I would only like to hear speculation of the community and not professional opinions.

(15 May '17, 06:15) qrv3w

One Answer:

1

Generally speaking, Wireshark is a tool. A tool can be used legally, and it can be used illegally. There is nothing intrinsically illegal about the tool itself.

Specific laws in specific countries will vary, but I can think of cases where it could be used illegally in the US. For example, if you were to break into the wire closet of a building, set up some taps and used Wireshark to intercept an enterprise's VoIP calls, I have to think that would be illegal. Meanwhile if you use Wireshark as a network administrator to troubleshoot your network, that would almost certainly not be.

answered 14 May '17, 19:04

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%