Searches for 'Wireshark download for Windows' often come from students or IT staff following a networking course or troubleshooting guide, so the Windows-specific installer and its Npcap dependency matter more than on other platforms. The Windows build bundles Npcap, the packet-capture driver Wireshark needs to see live network traffic, and installs both together in one setup wizard. Wireshark itself is completely free and open source under the GPL, with no paid tier.
Why the Windows Installer Includes Npcap
Unlike macOS or Linux, Windows has no built-in packet-capture driver, so Wireshark's Windows installer bundles Npcap, a Windows packet-capture library maintained by the Nmap project, and installs it alongside the main application.
Without Npcap, Wireshark can open and analyze saved capture files but cannot capture live traffic from a network interface, so it's worth leaving the Npcap component checked during setup even if you already have an older WinPcap install.
Who ends up using Wireshark
Network engineers, security analysts, and students learning protocol internals depend on Wireshark to inspect live traffic.
- Network administrators diagnosing latency or connectivity issues on a LAN
- Security analysts inspecting packet captures for suspicious traffic patterns
- Students and instructors following networking courses that teach protocol analysis
Before you install
A couple of things worth knowing about Wireshark before you request the link: it covers Windows, macOS and Linux, so pick the right build for the machine you're setting up. And on pricing, Wireshark is open source, so the installer is free with no trial timer, feature lock, or upsell screen to click past. It's developed and maintained by The Wireshark Foundation.
System requirements
- WindowsWindows 10 or 11 (64-bit); older 7/8.1 builds usually still run but no longer get official support
- macOSa recent macOS release — check the download page for the current minimum version, since Apple Silicon vs Intel builds sometimes differ
- Linuxmost current 64-bit distributions; look for a native .deb/.rpm/AppImage or a package in your distro's own repository
Heavier workloads (large files, high-res media, big projects) will naturally want more RAM and a faster CPU/GPU than the bare minimum.
Quick steps
- Download the Wireshark Windows installer
- Run it and keep Npcap selected when prompted during setup
- Launch Wireshark and select a network interface to start capturing
Wireshark: the honest trade-offs
- Deep protocol dissection covers hundreds of network protocols out of the box
- Powerful display filters make isolating specific traffic fast
- Completely free and open source with active ongoing development
- Steep learning curve for anyone unfamiliar with networking concepts
- Capturing on Windows depends on the separate Npcap driver being installed
This links to Wireshark's official Windows build from the Wireshark Foundation's own distribution, matching the checksums published on wireshark.org.
Other Developer Tools downloads people search for
Browse the full Developer Tools category →
Keeping Wireshark up to date
Since Wireshark is open source, most Linux distributions keep it current through their own package manager. On Windows/macOS, re-running the installer from the official site (or an updater built into the app, if it has one) gets you the latest release. Sticking to the developer's own distribution channel — which is what this page links to — means you're never stuck on an old build with unpatched bugs just because a mirror site stopped updating its copy.
Features, install steps, alternatives and more detail live on the main Wireshark page.
Frequently asked questions
Do I need administrator rights to capture packets on Windows?
Yes, capturing live traffic requires the Npcap driver to have been installed with admin rights, and Wireshark itself typically needs elevated permissions to access network interfaces.
Can Wireshark for Windows open capture files made on Linux or macOS?
Yes, Wireshark's .pcap and .pcapng file formats are cross-platform, so a capture taken on Linux or macOS opens the same way in the Windows build.
