2.3. Installing Wireshark under Windows

Wireshark 2.1

2.3. Installing Wireshark under Windows

2.3.1. Installation Components

  • Wireshark - The network protocol analyzer that we all know and mostly love.
  • TShark - A command-line network protocol analyzer. If you haven’t tried it you should.
  • Wireshark 1 Legacy - The old (GTK+) user interface in case you need it.
    • Dissector Plugins - Plugins with some extended dissections.
    • Tree Statistics Plugins - Extended statistics.
    • Mate - Meta Analysis and Tracing Engine - User configurable extension(s) of the display filter engine, see https://wiki.wireshark.org/Mate for details.
    • SNMP MIBs - SNMP MIBs for a more detailed SNMP dissection.
    • Editcap - Reads a capture file and writes some or all of the packets into another capture file.
    • Text2Pcap - Reads in an ASCII hex dump and writes the data into a pcap capture file.
    • Reordercap - Reorders a capture file by timestamp.
    • Mergecap - Combines multiple saved capture files into a single output file.
    • Capinfos - Provides information on capture files.
    • Rawshark - Raw packet filter.
  • User’s Guide - Local installation of the User’s Guide. The Help buttons on most dialogs will require an internet connection to show help pages if the User’s Guide is not installed locally.

2.3.2. Additional Tasks

  • Start Menu Shortcuts - Add some start menu shortcuts.
  • Desktop Icon - Add a Wireshark icon to the desktop.
  • Quick Launch Icon - add a Wireshark icon to the Explorer quick launch toolbar.
  • Associate file extensions to Wireshark - Associate standard network trace files to Wireshark.

2.3.3. Install Location

2.3.4. Installing WinPcap

2.3.5. Windows installer command line options

  • runs the installer or uninstaller silently with default values. The silent installer will not install WinPCap.
  • installation of the desktop icon, - force installation, - don’t install, otherwise use default settings. This option can be useful for a silent installer.
  • installation of the quick launch icon, - force installation, - don’t install, otherwise use default settings.
  • sets the default installation directory ($INSTDIR), overriding InstallDir and InstallDirRegKey. It must be the last parameter used in the command line and must not contain any quotes even if the path contains spaces.
  • disables the CRC check. We recommend against using this flag.
> Wireshark-win64-wireshark-2.0.5.exe /NCRC /S /desktopicon=yes /quicklaunchicon=no /D=C:\Program Files\Foo

2.3.6. Manual WinPcap Installation

2.3.7. Update Wireshark

2.3.8. Update WinPcap

2.3.9. Uninstall Wireshark

2.3.10. Uninstall WinPcap