User Guide

Introduction

1.1.7. Open Source Software

Wireshark is an open source software project, and is released under the GNU General Public License

(GPL). You can freely use Wireshark on any number of computers you like, without worrying about license

keys or fees or such. In addition, all source code is freely available under the GPL. Because of that, it is

very easy for people to add new protocols to Wireshark, either as plugins, or built into the source, and

they often do!

1.1.8. What Wireshark is not

Here are some things Wireshark does not provide:

• Wireshark isn't an intrusion detection system. It will not warn you when someone does strange things

on your network that he/she isn't allowed to do. However, if strange things happen, Wireshark might

help you figure out what is really going on.

• Wireshark will not manipulate things on the network, it will only "measure" things from it. Wireshark

doesn't send packets on the network or do other active things (except for name resolutions, but even

that can be disabled).

1.2. System Requirements

What you'll need to get Wireshark up and running ...

1.2.1. General Remarks

• The values below are the minimum requirements and only "rules of thumb" for use on a moderately

used network

• Working with a busy network can easily produce huge memory and disk space usage! For example:

Capturing on a fully saturated 100MBit/s Ethernet will produce ~ 750MBytes/min! Having a fast

processor, lots of memory and disk space is a good idea in that case.

• If Wireshark is running out of memory it crashes, see: http://wiki.wireshark.org/KnownBugs/

OutOfMemory for details and workarounds

• Wireshark won't benefit much from Multiprocessor/Hyperthread systems as time consuming tasks like

filtering packets are single threaded. No rule is without exception: during an "Update list of packets in

real time" capture, capturing traffic runs in one process and dissecting and displaying packets runs in

another process - which should benefit from two processors.

1.2.2. Microsoft Windows

• Windows XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003, Vista, 2008, 7, or 2008 R2

• Any modern 32-bit x86 or 64-bit AMD64/x86-64 processor.

• 128MB available RAM. Larger capture files require more RAM.

• 75MB available disk space. Capture files require additional disk space.

• 800*600 (1280*1024 or higher recommended) resolution with at least 65536 (16bit) colors (256 colors

should work if Wireshark is installed with the "legacy GTK1" selection of the Wireshark 1.0.x releases)

• A supported network card for capturing: