Wireshark captures traffic on a network interface and lets you inspect it packet by packet, decoding hundreds of protocols so you can see exactly what a device is sending and receiving. It is free, open source, and has been the de facto standard packet analyzer for network engineers, security researchers and developers for over 20 years.
What Wireshark Is Used For
Wireshark is not a general "internet speed" or monitoring tool — it is a packet-level protocol analyzer. Typical uses include diagnosing why an application is slow or failing to connect, verifying that an app is actually encrypting traffic it claims to encrypt, reverse-engineering an unfamiliar protocol, teaching networking concepts, and investigating suspicious traffic during a security incident.
Under the hood it relies on libpcap/Npcap (installed alongside it on Windows) to capture raw packets from a network interface, then applies its own dissectors to decode each protocol layer — Ethernet, IP, TCP/UDP, and everything running on top, from HTTP to DNS to custom application protocols.
Wireshark Features
- Live capture on wired, Wi-Fi, Bluetooth and virtual interfaces
- Deep protocol decoding for hundreds of protocols, from Ethernet up to application-layer traffic
- Powerful display filters to isolate exactly the packets you care about, e.g.
http.requestortcp.port==443 - Follow TCP/UDP stream to reconstruct a full conversation as readable text
- Read and write standard capture formats (pcap/pcapng), compatible with tcpdump and other tools
- Colour-coded packet list so errors, retransmissions and specific protocols stand out at a glance
- Cross-platform and open source, built on the widely-used Qt and libpcap libraries
How to Install Wireshark
- Open the official download page. The button on this page opens wireshark.org directly.
- Download the installer for your OS — the Windows build bundles Npcap, the packet-capture driver Wireshark needs.
- Run the installer and accept the Npcap driver install when prompted; it is required for live capture and is from the same trusted maintainers as Wireshark itself.
- On Linux, install via your distribution's package manager (e.g.
apt install wireshark) and add your user to thewiresharkgroup to capture without root. - Launch Wireshark, select a network interface from the start screen, and click the blue shark-fin icon to start capturing.
Is Wireshark really free?
Open Source. Wireshark is released under the GNU GPLv2. The source is public and the official builds are free for personal, educational and commercial use.
How to download Wireshark safely
Use the request button on this page and we will email you the current link for www.wireshark.org — the publisher's own website — so you receive the authentic build. We do not host, mirror, patch or repackage this software in any way.
Avoid third-party "download manager" sites offering Wireshark. They commonly wrap the genuine installer in their own bundler, which is how adware and browser hijackers get onto a machine that the user believed was clean.
Alternatives to Wireshark
Other free developer tools software worth comparing before you decide:
PuTTY
The classic free SSH, Telnet and serial terminal client.
Node.js
JavaScript runtime for building servers, tools and APIs.
Docker Desktop
Build, run and share containerised applications.
Frequently asked questions
Is Wireshark legal to use?
Yes, running Wireshark itself is legal. What matters is what you capture: capturing traffic on a network you own or have explicit permission to monitor is fine; intercepting traffic on a network you do not control or own can be illegal depending on your jurisdiction.
Do I need administrator rights to use Wireshark?
To capture live traffic, yes — packet capture requires elevated privileges on both Windows and Linux, because it involves putting a network interface into promiscuous mode. Opening and analysing an already-saved capture file does not require admin rights.
Can Wireshark decrypt HTTPS traffic?
Only if you have the session keys — for example, by pointing the SSLKEYLOGFILE environment variable at a log file that your browser writes to. Wireshark cannot break TLS encryption on its own; it can only decode traffic it has the correct key material for.
What is the difference between Wireshark and tcpdump?
tcpdump is a lightweight command-line capture tool included on most Linux systems; Wireshark is a full graphical analyzer with far deeper protocol decoding and filtering. A common workflow is capturing with tcpdump on a remote server and opening the resulting .pcap file in Wireshark for analysis.
Is Npcap the same as WinPcap?
No — WinPcap is discontinued and no longer maintained. Modern Wireshark installers on Windows bundle Npcap, its actively maintained successor, which also supports loopback capture and works on current Windows versions.
Tell us what went wrong — a person reads every message and replies. Corrections to this page are treated as priority fixes.
People also search for
The terms visitors use to find this page. Each one lands here because it describes the same program.
Searches from India
Wireshark is identical worldwide — these are search phrasings, not different downloads. Every one of them gets the same official build from www.wireshark.org.
