Wireshark

Wireshark decodes network traffic packet by packet. It reads capture files in pcap and pcapng format and presents each frame with its protocol layers expanded into a tree, from Ethernet and IP up through TCP or UDP to whatever application protocol sits on top, with the raw bytes shown alongside and highlighted as fields are selected.

Its display filter language is where most of the work happens: an expression naming a host, a port, a protocol or a field comparison narrows thousands of frames down to the conversation in question. Frames belonging together can be followed as a reassembled stream, and the statistics menus summarise conversations, endpoints, protocol distribution and response times. TLS traffic can be decoded when the session keys are supplied, and a large number of application protocols have dedicated dissectors.

The packaging described here is noted as being without live capture support, so it operates on files captured elsewhere, for example by tcpdump or dumpcap on the machine that sees the traffic. Reading an existing capture file needs no elevated privileges.