Wireshark

ApplicationWireshark Foundation

Also called ethereal, wireshark analyzer

Wireshark FoundationSystem

A packet capture and analyzer. The process is Wireshark.exe. Npcap is the usual Windows capture driver. It is not Resource Monitor.

What you need to know

Wireshark decodes packets. Resource Monitor only shows totals.

Wireshark Foundation's Wireshark captures and decodes traffic. Get it from wireshark.org. Npcap is the usual Windows driver. Resource Monitor is not a packet decoder. Nmap is a scanner.

What is it?: A packet capture and analyzer
Same as Resource Monitor?: No. resmon shows totals, not decodes
Windows driver?: Npcap is the usual capture driver

Feex says

If the question is "what did this PC send", I would capture in Wireshark with Npcap. I would not use Resource Monitor for a protocol decode. I would also not scan other people's networks without permission.

What is Wireshark?

Wireshark.exe decodes packet captures. dumpcap.exe records. Npcap is the Windows driver most installs use. Resource Monitor is resmon.exe and does not decode protocols.

If you have never used it

If you need to see packets on the wire, Wireshark is the Wireshark Foundation analyzer. Download it from wireshark.org. On Windows it usually installs Npcap as the capture driver. It is not Resource Monitor, which only shows process network totals, and it is not Nmap.

What is it used for?

Capture and decode packets

TCP, TLS handshakes, and more. Resource Monitor will not show a DNS query decode.

Open a pcap someone sent

File > Open. Nmap is a scanner. It does not replace this decode window.

Filter with display filters

http or dns filters live here. They are not Resource Monitor's process list.

Who is it for?

People hunting a bad DNS or a TLS failure
Students in a networking class
Anyone who should capture only on networks they are allowed to watch

Current status

Wireshark (1998) is a current packet analyzer from Wireshark Foundation. The vendor still points Windows users at https://www.wireshark.org/download.html.

How old is it?

Gerald Combs released Ethereal in 1998. The project renamed to Wireshark in 2006. Resource Monitor is an in-box Windows view. Current Wireshark still ships from wireshark.org.

Versions

Major channels first. Exact build numbers are not all verified here.

Stable Windows x64

Old stable

System requirements

Values follow the publisher's public guidance. Workload still changes the real need.

Minimum

Minimum system requirements
Operating system	Windows 10 or Windows 11, per current wireshark.org Windows builds
RAM	Enough for Windows plus this app. Heavy projects want more.

Resource profile

CPU demand: Rises with packet rate and dissectors
RAM demand: A large pcap can be huge in memory
Disk demand: The capture file grows fast on a busy LAN

Installed processes

These executables belong to this product when it is installed.

Installed processes
Wireshark.exe	Analyzer window
dumpcap.exe	Capture helper

Startup components

Wireshark should not start with Windows. Npcap is a driver, not a tray app you leave capturing.

File locations

Common Wireshark locations
Typical install	C:\Program Files\Wireshark\

File formats

PCAPPCAPNG

Common problems

Capture permission or missing Npcap

Re-run the Wireshark installer and include Npcap. Resource Monitor does not need a capture driver.

Huge pcap fills the disk

Use a capture filter. Process Monitor is the other tool whose log grows fast. This one grows on the wire.

Getting unstuck

Download from wireshark.org/download.html

Install Npcap when the setup asks. Resource Monitor is already on Windows if you only wanted process totals.

Run as administrator if no interfaces appear

Capture needs permission plus Npcap. Nmap has its own driver story (Npcap too) but it is a scanner.

Use a capture filter if the pcap is huge

host and port filters cut the file. Display filters hide rows after the fact.

Alternatives

Resource Monitor for simple totals. Nmap for port scans. pktmon on current Windows for a Microsoft capture path.

Official help and downloads

Start with the vendor. Random exe sites are not a support channel.

Official contacts
Download	www.wireshark.org/download.html Official installer or vendor page
Help	www.wireshark.org/docs/ Vendor support
Official site	www.wireshark.org/ Start here, not a random exe host

Related hardware

A NIC you are allowed to capture on. Promiscuous mode is a network policy question, not a GPU need.

Technical details

Vendor version numbers change. This article does not pin a build.

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Wireshark official site · Vendor product page
Wireshark help · Vendor support
Npcap · Usual Windows capture driver Wireshark uses
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.