SoftNexi

Windows · Networking

Wireshark for Windows

Free, open-source packet analyzer that captures and dissects live traffic across hundreds of protocols for troubleshooting and analysis.

Updated August 9, 2026 · Reviewed by SoftNexi Editorial Team, Software research and documentation

Download

Overview

Wireshark is the de facto standard network protocol analyzer. It captures packets from a network interface (via the Npcap driver on Windows) and decodes them with a library of protocol dissectors that cover everything from Ethernet and IP up through HTTP, TLS, DNS, and hundreds of application-layer protocols.

The core workflow is capture, filter, inspect. Display filters (using Wireshark's own filter syntax, distinct from capture filters) let you narrow a large capture down to a single conversation, a specific host, or packets matching a protocol field. Follow TCP/UDP/HTTP stream reassembles a whole exchange into readable form, which is often the fastest way to see what actually happened on the wire.

It is aimed at network administrators, security analysts, and developers debugging protocol-level issues, not casual users. There is a real learning curve: understanding capture filters versus display filters, promiscuous mode, and how switched networks limit what you can see without a mirror port or tap. For simpler connectivity checks, a lighter tool is usually faster.

Wireshark reads what is on the network, including unencrypted credentials and personal data if they happen to pass through a capture. Using it against traffic you do not own or have permission to monitor can violate wiretapping and privacy laws, so its use is generally limited to your own systems or networks you are authorized to analyze.

Key features

  • Live capture from wired, wireless, and virtual interfaces via Npcap
  • Dissectors for hundreds of protocols, from Ethernet through HTTP/2 and TLS
  • Powerful display filter language separate from BPF-style capture filters
  • Follow TCP/UDP/HTTP/TLS stream to reassemble a full conversation
  • Statistics tools including I/O graphs, conversations, and protocol hierarchy
  • Read and write standard pcap/pcapng capture files shared with other tools
  • TLS decryption when session keys are supplied (for example via SSLKEYLOGFILE)

System requirements

Operating system
Windows 11 and Windows 10 (64-bit)
Driver
Npcap installed alongside Wireshark for live capture
Permissions
Administrator rights to install the capture driver

How to install Wireshark

  1. 1. Download the installer

    Go to wireshark.org/download.html and choose the Windows Installer matching your architecture (x64 for most PCs).

  2. 2. Install Npcap

    During setup, accept the bundled Npcap installation — this is the driver that lets Wireshark capture live traffic.

  3. 3. Grant capture permissions

    Approve the option to allow non-administrator capture if you want to run Wireshark without elevation afterward.

  4. 4. Verify capture works

    Launch Wireshark, select an active interface showing traffic in the sparkline, and click it to start a capture.

How to use it

  1. 1. Start a targeted capture

    Use a capture filter (for example host 192.168.1.10) to limit what's recorded, keeping large captures manageable.

  2. 2. Filter the results

    Apply a display filter like http or tcp.port == 443 in the filter bar to isolate the traffic you care about.

  3. 3. Reassemble a conversation

    Right-click a packet and choose Follow > TCP Stream to read an entire exchange in order.

  4. 4. Save selectively

    Export only the filtered packets you need (File > Export Specified Packets) instead of sharing a full raw capture, since captures can contain sensitive data.

Safety and privacy

  • Download only from wireshark.org; the installer bundles the official Npcap driver from the same project.
  • Wireshark is open source, so both the application and Npcap are publicly reviewable.
Bundled software
The official Windows installer includes Npcap, the packet-capture driver Wireshark requires; it offers no unrelated third-party bundling.
Privacy
Wireshark runs locally and does not transmit captured traffic anywhere. Capture files can contain sensitive data (passwords, personal information), so treat saved .pcapng files as confidential.

Known risks

  • Capturing or analyzing network traffic you do not own or lack authorization to monitor can violate wiretapping, computer-misuse, or workplace policy rules in many US states — only use it on networks and systems you control or have explicit permission to test.
  • Running with elevated capture privileges on a shared machine widens what an attacker could see if the machine is compromised; keep the software updated.

What's new

    Pros and cons

    Pros

    • Free, open source, and extremely thorough protocol coverage
    • Industry-standard display filter language
    • Cross-platform pcap format compatible with tcpdump and other tools
    • Active development and a large community of dissector contributors
    • Deep TLS and stream-reassembly tooling

    Cons

    • Steep learning curve for filter syntax and capture concepts
    • Requires the Npcap driver and often administrator rights
    • Can be overkill for simple connectivity troubleshooting
    • Large captures can be slow to load and analyze on modest hardware

    Verdict

    Wireshark is the standard tool for anyone who genuinely needs to see what is happening at the packet level. It has real depth and a learning curve to match, so casual users troubleshooting a single dropped connection may be better served by simpler diagnostics first.

    Frequently asked questions

    Is Wireshark free?

    Yes. Wireshark is open source under the GNU GPLv2 and has no paid tier.

    Is it legal to use Wireshark?

    The software itself is legal; how you use it may not be. Capturing traffic on a network you own or are authorized to monitor is generally fine, but intercepting traffic without permission can violate US wiretapping and computer-misuse laws.

    Does Wireshark work on Windows 11?

    Yes, current Wireshark releases support Windows 11 and Windows 10 on 64-bit and ARM64 hardware.

    Why can't Wireshark see traffic between two other devices on my network?

    Modern switched networks only deliver traffic addressed to your machine. Seeing other devices' traffic generally requires a switch mirror/SPAN port, a network tap, or capturing on the device itself.