# Wireshark

Application: Wireshark Foundation

Also called ethereal, wireshark analyzer

Wireshark Foundation, System

A packet capture and analyzer. The process is Wireshark.exe. Npcap is the usual Windows capture driver. It is not Resource Monitor.

## What you need to know

Wireshark decodes packets. Resource Monitor only shows totals.

Wireshark Foundation's Wireshark captures and decodes traffic. Get it from wireshark.org. Npcap is the usual Windows driver. Resource Monitor is not a packet decoder. Nmap is a scanner.

- **What is it?**: A packet capture and analyzer

  **Same as Resource Monitor?**: No. resmon shows totals, not decodes

  **Windows driver?**: Npcap is the usual capture driver

Feex says

If the question is "what did this PC send", I would capture in Wireshark with Npcap. I would not use Resource Monitor for a protocol decode. I would also not scan other people's networks without permission.

## What is Wireshark?

Wireshark.exe decodes packet captures. dumpcap.exe records. Npcap is the Windows driver most installs use. Resource Monitor is resmon.exe and does not decode protocols.

## If you have never used it

If you need to see packets on the wire, Wireshark is the Wireshark Foundation analyzer. Download it from wireshark.org. On Windows it usually installs Npcap as the capture driver. It is not Resource Monitor, which only shows process network totals, and it is not Nmap.

## What is it used for?

**Capture and decode packets**

TCP, TLS handshakes, and more. Resource Monitor will not show a DNS query decode.

**Open a pcap someone sent**

File > Open. Nmap is a scanner. It does not replace this decode window.

**Filter with display filters**

http or dns filters live here. They are not Resource Monitor's process list.

## Who is it for?

- People hunting a bad DNS or a TLS failure
- Students in a networking class
- Anyone who should capture only on networks they are allowed to watch

## Current status

Wireshark (1998) is a current packet analyzer from Wireshark Foundation. The vendor still points Windows users at https://www.wireshark.org/download.html.

## How old is it?

Gerald Combs released Ethereal in 1998. The project renamed to Wireshark in 2006. Resource Monitor is an in-box Windows view. Current Wireshark still ships from wireshark.org.

## Versions

Major channels first. Exact build numbers are not all verified here.

Stable Windows x64

Old stable

## System requirements

Values follow the publisher's public guidance. Workload still changes the real need.

### Minimum

| Operating system | Windows 10 or Windows 11, per current wireshark.org Windows builds |
| ---------------- | ------------------------------------------------------------------ |
| RAM              | Enough for Windows plus this app. Heavy projects want more.        |

## Resource profile

- **CPU demand**: Rises with packet rate and dissectors

  **RAM demand**: A large pcap can be huge in memory

  **Disk demand**: The capture file grows fast on a busy LAN

## Installed processes

These executables belong to this product when it is installed.

| Wireshark.exe | Analyzer window |
| ------------- | --------------- |
| dumpcap.exe   | Capture helper  |

## Startup components

Wireshark should not start with Windows. Npcap is a driver, not a tray app you leave capturing.

## File locations

| Typical install | C:\Program Files\Wireshark\\ |
| --------------- | ---------------------------- |

## File formats

PCAP, PCAPNG

## Common problems

### Capture permission or missing Npcap

Re-run the Wireshark installer and include Npcap. Resource Monitor does not need a capture driver.

### Huge pcap fills the disk

Use a capture filter. Process Monitor is the other tool whose log grows fast. This one grows on the wire.

## Getting unstuck

### Download from wireshark.org/download.html

Install Npcap when the setup asks. Resource Monitor is already on Windows if you only wanted process totals.

### Run as administrator if no interfaces appear

Capture needs permission plus Npcap. Nmap has its own driver story (Npcap too) but it is a scanner.

### Use a capture filter if the pcap is huge

host and port filters cut the file. Display filters hide rows after the fact.

## Alternatives

Resource Monitor for simple totals. Nmap for port scans. pktmon on current Windows for a Microsoft capture path.

## Official help and downloads

Start with the vendor. Random exe sites are not a support channel.

| Download      | [www.wireshark.org/download.html ](https://www.wireshark.org/download.html)Official installer or vendor page |
| ------------- | ------------------------------------------------------------------------------------------------------------ |
| Help          | [www.wireshark.org/docs/ ](https://www.wireshark.org/docs/)Vendor support                                    |
| Official site | [www.wireshark.org/ ](https://www.wireshark.org/)Start here, not a random exe host                           |

## Related hardware

A NIC you are allowed to capture on. Promiscuous mode is a network policy question, not a GPU need.

## Technical details

Technical details

Vendor version numbers change. This article does not pin a build.

## Related

These entities connect to this article. Type is shown on every link.

[Nmap: Application](https://feex.it/wiki/software/nmap)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Wireshark official site ](https://www.wireshark.org/)· Vendor product page
- [Wireshark help ](https://www.wireshark.org/docs/)· Vendor support
- [Npcap ](https://npcap.com/)· Usual Windows capture driver Wireshark uses
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Developer**: Wireshark Foundation

  **Category**: Packet analyzer

  **Process**: Wireshark.exe

  **License**: GPLv2

  **First released**: 1998

  **Official site**: [wireshark.org](https://www.wireshark.org/)

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/software/wireshark/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)