User Guide

1.2. System Requirements
What you'll need to get Wireshark up and running ...
1.2.1. General Remarks
The values below are the minimum requirements and only "rules of thumb" for use on a moder-
ately used network
Working with a busy network can easily produce huge memory and disk space usage! For ex-
ample: Capturing on a fully saturated 100MBit/s Ethernet will produce ~ 750MBytes/min! Hav-
ing a fast processor, lots of memory and disk space is a good idea in that case.
If Wireshark is running out of memory it crashes, see: http://wiki.wireshark.org/KnownBugs/
OutOfMemory for details and workarounds
Wireshark won't benefit much from Multiprocessor/Hyperthread systems as time consuming
tasks like filtering packets are single threaded. No rule without exception: during an "Update list
of packets in real time" capture, capturing traffic runs in one process and dissecting and display-
ing packets runs in another process - which should benefit from two processors.
1.2.2. Microsoft Windows
Windows 2000, XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003 or Vista (XP
Pro recommended)
32-bit Pentium or alike (recommended: 400MHz or greater), 64-bit processors in WoW64 emu-
lation - see remarks below
128MB RAM system memory (recommended: 256MBytes or more)
75MB available disk space (plus size of user's capture files, e.g. 100MB extra)
800*600 (1280*1024 or higher recommended) resolution with at least 65536 (16bit) colors (256
colors should work if Wireshark is installed with the "legacy GTK1" selection)
A supported network card for capturing:
Ethernet: any card supported by Windows should do
WLAN: see the MicroLogix support list, no capturing of 802.11 headers and non-data
frames
Other media: See http://wiki.wireshark.org/CaptureSetup/NetworkMedia
Remarks:
Older Windows versions are no longer supported because of three reasons: None of the de-
velopers actively use those systems any longer which makes support difficult. The libraries
Wireshark depends on (GTK, WinPCap, ...) also dropping support for these systems. Microsoft
also dropped support for these systems.
Windows 95, 98 and ME will no longer work with Wireshark. The last known version to work
was Ethereal 0.99.0 (which includes WinPcap 3.1), you still can get it from: http://ethereal.com/
download.html. BTW: Microsoft no longer supports 98/ME since July 11, 2006!
Introduction
4