Capture and analyze network traffic with 3,000+ protocol support. Free, open-source, trusted by professionals worldwide.
File size: 92.2 MB • License: GPLv2+ (Free) • Includes Npcap driver
| Version | 4.6.4 (Stable) — February 27, 2026 |
| File Size | 92.2 MB (Windows 64-bit installer) |
| License | Free & Open Source (GPLv2+) |
| Developer | Wireshark Foundation |
| Operating System | Windows 10/11, macOS 11+, Linux |
| Protocols | 3,000+ supported |
| Includes | Npcap packet capture driver (Windows) |
| SHA256 | Verify at wireshark.org/download |
Wireshark is the world's most widely used network protocol analyzer. Originally released as Ethereal in 1998 by Gerald Combs, it was rebranded as Wireshark in 2006 and is now maintained by the Wireshark Foundation. Your Wireshark download includes over 3,000 protocol dissectors out of the box.
It lets you capture live network traffic and inspect individual packets at a granular level. Network administrators use it to troubleshoot connectivity issues, security analysts use it to detect suspicious traffic, and developers use it to debug application protocols. Wireshark handles everything from basic TCP/IP to specialized industrial and wireless protocols.
The Wireshark download is completely free, open-source under GPLv2+, and available for Windows, macOS, and Linux. The Windows installer bundles the Npcap driver, which is required for live packet capture.
Use the Wireshark download button above to get the Windows 64-bit installer (92.2 MB). If you need the 32-bit version, use the alternate link in the hero section.
Double-click the downloaded Wireshark-4.6.4-x64.exe file. Click "Yes" on the UAC prompt to allow the installer to run with administrator privileges.
Review the GPLv2 license terms and click "Noted" or "I Agree" to continue with installation.
The installer will offer to install Npcap (the packet capture driver). Keep this checked — Wireshark cannot capture live traffic without it. Accept the Npcap defaults unless you have a specific configuration need.
Choose your install location (default is fine for most users) and click "Install." The process takes 1-2 minutes.
Open Wireshark from the Start menu. You'll see a list of network interfaces with live traffic graphs. Double-click your active connection (usually "Ethernet" or "Wi-Fi") to begin capturing packets. See our Wireshark tutorial for filters and analysis.
Solutions to the most frequently reported problems after your Wireshark download and installation.
This usually happens when Npcap is configured with the "Restrict Npcap driver's access to Administrators only" option. Wireshark 4.6.4 fixed this issue, so updating to the latest version resolves it. If you're on an older version, reinstall Npcap and uncheck the administrator-only restriction during setup.
This means Npcap is either not installed or the service isn't running. First, check if the Npcap service is active: open Command Prompt as admin and run sc query npcap. If it shows "STOPPED," start it with net start npcap. If Npcap isn't installed at all, download it from npcap.com and install it separately.
Brief network interruption during Npcap installation is normal — the driver binds to your network adapter, which requires a momentary disconnect. If connectivity doesn't return within 90 seconds, reboot your computer. Persistent issues may require reinstalling Npcap in Safe Mode: boot into Safe Mode with Networking, uninstall Npcap, reboot normally, then reinstall.
On Windows, run Wireshark as administrator (right-click → "Run as administrator"). On Linux, add your user to the wireshark group: sudo usermod -aG wireshark $USER, then log out and back in. On macOS, the ChmodBPF utility (included in the .dmg) sets the correct permissions during installation — if it wasn't installed, run it manually from the .dmg.
Large captures (100MB+) can strain memory. Use capture filters to limit what's recorded: for example, host 192.168.1.100 captures only traffic to/from that IP. You can also use ring buffers (Capture → Options → Output) to automatically split captures into smaller files. For analysis of very large files, consider using TShark (the command-line version) instead of the GUI.
SSLKEYLOGFILE), Wireshark can decrypt and display the contents of HTTPS sessions. This is commonly used for debugging web applications in development environments.Wireshark maintains two active release branches. Security updates are applied to both. Always use the latest Wireshark download for security patches.
| Version | Release Date | Branch | Key Changes |
|---|---|---|---|
| 4.6.4 | Feb 27, 2026 | Current Stable | 3 security fixes (CVE-2026-3201/3202/3203), Npcap admin fix, Expert Info performance |
| 4.6.3 | Jan 14, 2026 | Current Stable | Security patches, dissector bug fixes |
| 4.6.2 | Dec 3, 2025 | Current Stable | Bug fixes, protocol updates |
| 4.6.1 | Nov 20, 2025 | Current Stable | Security fixes, stability improvements |
| 4.6.0 | Oct 9, 2025 | Current Stable | New branch release, new protocol dissectors |
| 4.4.14 | Feb 2026 | Old Stable | Security patches (maintained parallel branch) |
| 4.4.13 | Jan 14, 2026 | Old Stable | Security patches |
| 4.4.12 | Dec 10, 2025 | Old Stable | Bug fixes |
| 4.4.11 | Oct 31, 2025 | Old Stable | Security and stability fixes |
| 4.4.10 | Sep 19, 2025 | Old Stable | Dissector fixes |
| 4.4.0 | Aug 29, 2024 | Old Stable | Branch release, new features |
| 4.2.0 | Nov 15, 2023 | EOL | Last to support Windows 10 32-bit + macOS 10.14 |
| 4.0.0 | Oct 4, 2022 | EOL | Qt 6, last Windows 8.1 support |
| 3.6.0 | Dec 15, 2021 | EOL | Last 3.x series release |
| 1.0.0 | Mar 31, 2008 | Historical | First release under the Wireshark name |
Windows 10/11 (64-bit recommended)
macOS 11 Big Sur or later
brew install wiresharkMost distributions supported
sudo apt install wiresharksudo dnf install wiresharksudo pacman -S wireshark-qt