User Guide

1.2. System Requirements

What you'll need to get Wireshark up and running ...

1.2.1. General Remarks

• The values below are the minimum requirements and only "rules of thumb" for use on a moder-

ately used network

• Working with a busy network can easily produce huge memory and disk space usage! For ex-

ample: Capturing on a fully saturated 100MBit/s Ethernet will produce ~ 750MBytes/min! Hav-

ing a fast processor, lots of memory and disk space is a good idea in that case.

• If Wireshark is running out of memory it crashes, see: http://wiki.wireshark.org/KnownBugs/

OutOfMemory for details and workarounds

• Wireshark won't benefit much from Multiprocessor/Hyperthread systems as time consuming

tasks like filtering packets are single threaded. No rule is without exception: during an "Update

list of packets in real time" capture, capturing traffic runs in one process and dissecting and dis-

playing packets runs in another process - which should benefit from two processors.

1.2.2. Microsoft Windows

• Windows 2000, XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003, Vista or

Windows 2008 (XP Pro recommended)

• 32-bit Pentium or alike (recommended: 400MHz or greater), 64-bit processors in WoW64 emu-

lation - see remarks below

• 128MB RAM system memory (recommended: 256MBytes or more)

• 75MB available disk space (plus size of user's capture files, e.g. 100MB extra)

• 800*600 (1280*1024 or higher recommended) resolution with at least 65536 (16bit) colors (256

colors should work if Wireshark is installed with the "legacy GTK1" selection of the Wireshark

1.0.x releases)

• A supported network card for capturing:

• Ethernet: any card supported by Windows should do

• WLAN: see the MicroLogix support list, no capturing of 802.11 headers and non-data

frames

• Other media: See http://wiki.wireshark.org/CaptureSetup/NetworkMedia

Remarks:

• Older Windows versions are no longer supported because of three reasons: None of the de-

velopers actively use those systems any longer which makes support difficult. The libraries

Wireshark depends on (GTK, WinPCap, ...) are also dropping support for these systems. Mi-

crosoft also dropped support for these systems.

• Windows 95, 98 and ME will no longer work with Wireshark. The last known version to work

was Ethereal 0.99.0 (which includes WinPcap 3.1). You can get it from http:/ / ethereal.com/

download.html. According to this bug report, you may need to install Ethereal 0.10.0 on some

Introduction