What Wireshark does
Wireshark is a GPL-licensed protocol analyzer for inspecting saved capture files and, with an appropriate capture mechanism and permissions, recording live network traffic. It decodes protocol fields, applies capture and display filters, follows supported streams, and provides conversation, endpoint, hierarchy, and I/O statistics. Protocol dissection does not guarantee that encrypted application content is readable: following TLS normally requires suitable session secrets or private-key conditions documented by Wireshark, and decryption coverage depends on the protocol and cipher configuration.
This record pins Wireshark 4.6.8 Windows x64 and ARM64 installers, the Windows x64 MSI and portable package, a universal macOS disk image, and the upstream source tarball. The Linux row is source code, not a distribution-native binary; Linux users should normally follow their distribution or Wireshark's platform guidance. The project announcement publishes the SHA-256 values transcribed below and an OpenPGP-signed release message. This audit did not validate that signature or execute the packages.
On Windows, the interactive EXE can offer the separately licensed Npcap capture driver. Wireshark documents that silent installation of its EXE does not install Npcap; without a compatible capture driver, Wireshark can still open saved captures but cannot perform normal live capture. The MSI and portable package also do not erase driver, privilege, policy, or redistribution requirements. Npcap licensing can restrict redistribution and some organizational deployments, so administrators must review its current terms separately.
Packet capture can expose credentials, tokens, personal data, payloads, and unrelated users' traffic. Capture only traffic you are authorized to inspect, minimize capture privileges and scope, and protect or sanitize files before sharing. Running the graphical interface with elevated privileges is not a substitute for a least-privilege capture setup.
