# Wireshark

Application: Wireshark Foundation

Dem still dey call am ethereal, wireshark analyzer

Wireshark Foundation, System

Packet capture and analyzer tool. Di process na Wireshark.exe. Npcap na di usual Windows capture driver. E no be Resource Monitor.

## Wetin you need know

Wireshark dey decode packets. Resource Monitor only dey show totals.

Wireshark Foundation Wireshark dey capture and decode traffic. Get am from wireshark.org. Npcap na di usual Windows driver. Resource Monitor no be packet decoder. Nmap na scanner.

- **Wetin e be?**: Packet capture and analyzer

  **Same thing as Resource Monitor?**: No. resmon dey show totals, e no dey decode

  **Windows driver?**: Npcap na di usual capture driver

Feex tok say

If di question na "wetin dis PC send", I go capture inside Wireshark wit Npcap. I no go use Resource Monitor for protocol decode. I still no go scan other people network without permission.

## Wetin be Wireshark?

Wireshark.exe dey decode packet captures. dumpcap.exe dey record. Npcap na di Windows driver wey pass installs dey use. Resource Monitor na resmon.exe and e no dey decode protocols.

## If you never use am before

If you need make you see packets for wire, Wireshark na di Wireshark Foundation analyzer. Download am from wireshark.org. For Windows e dey usually install Npcap as di capture driver. E no be Resource Monitor, wey only dey show process network totals, and e no be Nmap.

## Wetin dem dey use am for?

**Capture and decode packets**

TCP, TLS handshakes, and more. Resource Monitor no go show DNS query decode.

**Open pcap wey somebody send**

File > Open. Nmap na scanner. E no dey replace dis decode window.

**Filter wit display filters**

http or dns filters dey live here. Dem no be Resource Monitor process list.

## Na who e dey for?

- People wey dey find bad DNS or TLS failure
- Students wey dey networking class
- Anybody wey suppose capture only on top networks wey dem get permission to watch

## Current status

Wireshark (1998) na current packet analyzer from Wireshark Foundation. Di vendor still dey direct Windows users go https://www.wireshark.org/download.html.

## How old e be?

Gerald Combs release Ethereal for 1998. Di project change name to Wireshark for 2006. Resource Monitor na in-box Windows view. Current Wireshark still dey come from wireshark.org.

## Versions

Major channels first. Exact build numbers no dey all verified here.

Stable Windows x64

Old stable

## System requirements

Values dey follow wetin di publisher release publicly. Workload still dey change di real need.

### Minimum

| Operating system | Windows 10 or Windows 11, according to current wireshark.org Windows builds |
| ---------------- | --------------------------------------------------------------------------- |
| RAM              | E reach for Windows plus dis app. Heavy projects go want more.              |

## Resource profile

- **CPU demand**: E dey increase wit packet rate and dissectors

  **RAM demand**: Big pcap fit huge well-well for memory

  **Disk demand**: Di capture file dey grow fast for busy LAN

## Installed processes

Dese executables belong to dis product when e dey installed.

| Wireshark.exe | Analyzer window |
| ------------- | --------------- |
| dumpcap.exe   | Capture helper  |

## Startup components

Wireshark no suppose start wit Windows. Npcap na driver, no be tray app wey you go leave make e dey capture.

## File locations

| Typical install | C:\Program Files\Wireshark\\ |
| --------------- | ---------------------------- |

## File formats

PCAP, PCAPNG

## Common wahala dem

### Capture permission or missing Npcap

Run di Wireshark installer again make you include Npcap. Resource Monitor no need capture driver.

### Huge pcap dey full di disk

Use capture filter. Process Monitor na di other tool wey im log dey grow fast. Dis one dey grow on top di wire.

## How to get unstuck

### Download from wireshark.org/download.html

Install Npcap when di setup ask. Resource Monitor already dey Windows if na only process totals you want.

### Run as administrator if no interfaces show

Capture need permission plus Npcap. Nmap get im own driver matter (Npcap too) but na scanner e be.

### Use capture filter if di pcap huge well-well

host and port filters dey reduce di file. Display filters dey hide rows after e don capture finish.

## Alternatives

Resource Monitor for simple totals. Nmap for port scans. pktmon on current Windows for Microsoft capture path.

## Official help and downloads

Start with di vendor. Random exe sites no be support channel.

| Download      | [www.wireshark.org/download.html ](https://www.wireshark.org/download.html)Official installer or vendor page |
| ------------- | ------------------------------------------------------------------------------------------------------------ |
| Help          | [www.wireshark.org/docs/ ](https://www.wireshark.org/docs/)Vendor support                                    |
| Official site | [www.wireshark.org/ ](https://www.wireshark.org/)Start here, no be random exe host                           |

## Related hardware

NIC wey you get permission to capture on top. Promiscuous mode na network policy matter, no be GPU need.

## Technical details

Technical details

Vendor version numbers dey change. Dis article no pin down any build.

## Related

Dis entities connect to dis article. Type dey show for every link.

[Nmap: Application](https://feex.it/wiki/l/pcm/software/nmap/)[How to read Task Manager: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Wireshark official site ](https://www.wireshark.org/)· Vendor product page
- [Wireshark help ](https://www.wireshark.org/docs/)· Vendor support
- [Npcap ](https://npcap.com/)· Usual Windows capture driver wey Wireshark dey use
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Developer**: Wireshark Foundation

  **Category**: Packet analyzer

  **Process**: Wireshark.exe

  **License**: GPLv2

  **First released**: 1998

  **Official site**: [wireshark.org](https://www.wireshark.org/)

  **Feex map am**: Dem see am on top Windows PCs for Foxhole

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/software/wireshark/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)