updated
Aug 13, 2026
98MB
file size
546
downloads
Wireshark is the free, open source network protocol analyzer that captures live traffic from your network interface and decodes it packet by packet against thousands of protocol dissectors, so you can read what your machines are actually saying to each other.
It puts your network interface into capture mode and records every packet in real time, then decodes each one against a library of thousands of protocol dissectors.
The result is that you can read the conversation between machines instead of guessing at it.
Version 4.6.8 is the current stable release, free under the GNU GPL v2 from the Wireshark Foundation, and the Windows installer here carries everything you need to start capturing.
What Wireshark Actually Does
At its core it answers one question: what is really happening on this connection? It captures packets straight from a live interface - Ethernet, Wi-Fi, loopback, USB and more - and parses them layer by layer.
That means the Ethernet frame, the IP header, the TCP or UDP segment and the application protocol riding on top, whether that is HTTP, DNS, TLS, SMB2, RDP or one of the hundreds of others it recognises.
From there you can apply display filters to isolate a single conversation, follow a TCP or TLS stream to read an exchange end to end, colour-code traffic by rule, and export captures for later.
The same engine ships as command-line tools. TShark handles scripted and headless capture, while editcap and mergecap trim and combine capture files.
What Is New in 4.6.8
This is a security release and not much else. It fixes 28 separate security advisories, adds no new features and adds no new protocol dissectors.
The advisories cover crashes in the RDP, SSH, Kerberos, C12.22, H.245 and several Bluetooth dissectors, along with a run of file-parser crashes in the Tektronix, ERF, BUSMASTER and pcapng readers. Two of them are in sharkd, the analysis back end.
WHY THIS MATTERS
Most Wireshark vulnerabilities are triggered by opening a malicious capture file rather than by capturing live traffic, which is why analysts who accept .pcap files from other people should stay current. The full list is in the 4.6.8 release notes.
The 4.6 series also fixed a run of 5G NAS decoding errors, a Windows hang in the Capture File Properties dialog that appeared in 4.6.6, and a segfault when toggling TCP sequence number analysis.
Npcap, the Part That Does the Capturing
Wireshark does not talk to your network card directly. On Windows it relies on Npcap, a separate capture driver that the installer bundles and offers to set up for you.
Without it Wireshark still opens and still reads saved .pcap and .pcapng files, but the interface list on the welcome screen will be empty and live capture will not work.
Recent installers ship Npcap 1.88. If you are upgrading from an older Wireshark and left the driver alone, updating it is worth doing, because a bug in Npcap 1.86 could produce a blue screen.
Coming from an old tutorial? WinPcap support was removed in Wireshark 4.6.0, so any guide telling you to install WinPcap is out of date. Uninstall it if it is still on the machine and let Npcap take over.
Installing on Windows
- Run the installer and accept the bundled Npcap component when prompted. This is the step people skip, and it is the one that makes live capture work.
- If you are upgrading, tick the optional features you want to keep. Windows upgrades do not retain them automatically, so components can disappear quietly.
- Launch Wireshark, pick your active interface from the welcome screen, and packets start scrolling straight away.
The download is a standard 64-bit Windows package and runs on Windows 10 and Windows 11. If the download itself stalls, trying a different browser usually clears it.
Wireshark or Something Simpler
Wireshark diagnoses, it does not control. If what you actually want is to shape or limit traffic rather than read it, a client like qBittorrent has the bandwidth controls built in and no packet capture is needed.
If you are capturing traffic to find a video URL, stop. yt-dlp already resolves those for hundreds of sites, and it will take you minutes rather than an afternoon of filtering.
For a one-off stream URL, the browser-based Stream Extractor pulls a playable link out of a page with nothing to install.
And if you only need to know which requests a web page makes, your browser's own developer tools show that without a capture driver or administrator rights.
Where It Helps With Streaming and IPTV
Packet capture earns its keep when a stream misbehaves and nothing in the player tells you why. A capture shows whether the segments are arriving late, arriving out of order, or not arriving at all.
For IPTV that is often the fastest route to an answer, and IPTV Checker will tell you which entries in a playlist are dead before you start capturing at all.
Once you have a working URL, the Web Player and HEVC Player let you test playback in the browser before blaming the network.
YouTube Playlist to M3U is the other one worth knowing about, since it turns a playlist into something a set-top client can actually read.
Home media servers are the other common case. Transcoding problems in Emby or Jellyfin Server look identical to network problems from the client side, and a capture separates the two in a couple of minutes.
FFmpeg is the natural partner once you have identified a stream, since it can pull, remux and re-encode whatever the traffic was carrying.
Capturing Traffic You Are Allowed to Capture
Wireshark is legitimate open source software used by enterprises, universities and security teams worldwide, and the build here is the unmodified official release.
Capture only what you are authorised to capture. Analysing traffic on networks you own or have been given permission to monitor is standard professional practice; monitoring a network without that permission is not, and in many places it is a criminal offence rather than a policy matter.
Wireshark can place an interface in promiscuous mode and read traffic that was never addressed to your machine, which is exactly why the permission question is not a formality.
If your aim is to protect your own traffic rather than study anyone else's, that is a different tool. Proton VPN encrypts your connection so that a capture running on the same network sees nothing readable, and the rest of the Security Tools category covers the defensive side.
Quick questions
Is Wireshark free?
Yes, entirely. It is open source under the GNU GPL v2, maintained by the nonprofit Wireshark Foundation, with no paid tier and no feature held back.
Do I have to install Npcap?
To capture live traffic, yes. Without it Wireshark can still open capture files someone else made, but your interface list will be empty.
Why is my interface list empty?
Almost always because Npcap is missing, or because Wireshark is not running with the rights the driver requires. Reinstalling and accepting the Npcap component fixes it in most cases.
Can Wireshark read HTTPS traffic?
Not by default, because TLS is encrypted. It can decrypt sessions when you supply the keys, typically through a session key log file from the browser making the connection.
Is it legal to use?
The software is legal everywhere. Capturing traffic on a network you do not own or have permission to monitor is the part that is not, and that varies by country.
Does it work on Windows 10?
Yes. Both Windows 10 and Windows 11 are supported, on 64-bit only, and a brief incompatibility with Windows 10 version 1809 that appeared in 4.6.5 was fixed in 4.6.6.
Our guides cover the streaming and playback side in more depth, and the browser-based online tools handle the quick checks with nothing to install.
Download Wireshark 4.6.8 and see what your network is really doing, or tell us how you got on if you have used it before.
