2.3. Installing Wireshark under Windows

2.3. Installing Wireshark under Windows

The official Windows packages can be downloaded from the Wireshark main page or the download page. Installer names contain the version and platform. For example, Wireshark-5.1.0-x64.exe installs Wireshark 5.1.0 for Windows on 64-bit Intel processors. The Wireshark installer includes Npcap which is required for packet capture. Windows packages automatically update. See Section 2.8, “Updating Wireshark” for details.

Simply download the Wireshark installer from <https://www.wireshark.org/download.html> and execute it. Official packages are signed by Wireshark Foundation. You can choose to install several optional components and select the location of the installed package. The default settings are recommended for most users.

2.3.1. Installation Components

On the Choose Components page of the installer you can select from the following:

  • Wireshark - The network protocol analyzer that we all know and mostly love.
  • TShark - A command-line network protocol analyzer. If you haven’t tried it you should.

  • External Capture (extcap) - External Capture Interfaces

  • Androiddump - Provide capture interfaces from Android devices.

  • Etwdump - Provide an interface to read Event Tracing for Windows (ETW) event trace (ETL).
  • Randpktdump - Provide an interface to the random packet generator. (see also randpkt)
  • Sshdump, Ciscodump, and Wifidump - Provide remote capture through SSH. (tcpdump, Cisco EPC, wifi)
  • UDPdump - Provide capture interface to receive UDP packets streamed from network devices.

2.3.2. Additional Tasks

  • Wireshark Start Menu Item - Add a shortcut to the start menu.
  • Wireshark Desktop Icon - Add a Wireshark icon to the desktop.
  • Associate trace file extensions with Wireshark - Associate standard network trace files to Wireshark.

2.3.3. Install Location

By default Wireshark installs into %ProgramFiles%\Wireshark on 32-bit Windows and %ProgramFiles64%\Wireshark on 64-bit Windows. This expands to C:\Program Files\Wireshark on most systems.

2.3.4. Installing Npcap

The Wireshark installer contains the latest Npcap installer.

If you don’t have Npcap installed you won’t be able to capture live network traffic but you will still be able to open saved capture files. By default the latest version of Npcap will be installed. If you don’t wish to do this or if you wish to reinstall Npcap you can check the Install Npcap box as needed.

For more information about Npcap see <https://npcap.com/> and <https://wiki.wireshark.org/Npcap>.

2.3.5. Windows installer command line options

For special cases, there are some command line parameters available:

  • /S runs the installer or uninstaller silently with default values. The silent installer will not install Npcap.
  • /desktopicon installation of the desktop icon, =yes - force installation, =no - don’t install, otherwise use default settings. This option can be useful for a silent installer.
  • /D sets the default installation directory ($INSTDIR), overriding InstallDir and InstallDirRegKey. It must be the last parameter used in the command line and must not contain any quotes even if the path contains spaces.
  • /NCRC disables the CRC check. We recommend against using this flag.

  • /EXTRACOMPONENTS comma separated list of optional components to install. The following extcap binaries are supported.

  • androiddump - Provide interfaces to capture from Android devices

  • ciscodump - Provide interfaces to capture from a remote Cisco router through SSH
  • randpktdump - Provide an interface to generate random captures using randpkt
  • sshdump - Provide interfaces to capture from a remote host through SSH using a remote capture binary
  • udpdump - Provide a UDP receiver that gets packets from network devices

Example:

> Wireshark-4.2.5-x64.exe /NCRC /S /desktopicon=yes /D=C:\Program Files\Foo

> Wireshark-4.2.5-x64.exe /S /EXTRACOMPONENTS=sshdump,udpdump

Running the installer without any parameters shows the normal interactive installer.

2.3.6. Manual Npcap Installation

As mentioned above, the Wireshark installer also installs Npcap. If you prefer to install Npcap manually or want to use a different version than the one included in the Wireshark installer, you can download Npcap from the main Npcap site at <https://npcap.com/>.

2.3.7. Update Npcap

Wireshark updates may also include a new version of Npcap. Manual Npcap updates instructions can be found on the Npcap web site at <https://npcap.com/>. You may have to reboot your machine after installing a new Npcap version.

2.3.8. Uninstall Wireshark

You can uninstall Wireshark using the Programs and Features control panel. Select the “Wireshark” entry to start the uninstallation procedure.

The Wireshark uninstaller provides several options for removal. The default is to remove the core components but keep your personal settings and Npcap. Npcap is kept in case other programs need it.

2.3.9. Uninstall Npcap

You can uninstall Npcap independently of Wireshark using the Npcap entry in the Programs and Features control panel. Remember that if you uninstall Npcap you won’t be able to capture anything with Wireshark.