1.2. System Requirements

What you'll need to get Wireshark up and running ...

1.2.1. General Remarks

  • The values below are the minimum requirements and only "rules of thumb" for use on a moderately used network

  • Working with a busy network can easily produce huge memory and disk space usage! For example: Capturing on a fully saturated 100MBit/s Ethernet will produce ~ 750MBytes/min! Having a fast processor, lots of memory and disk space is a good idea in that case.

  • If Wireshark is running out of memory it crashes, see: http://wiki.wireshark.org/KnownBugs/OutOfMemory for details and workarounds

  • Wireshark won't benefit much from Multiprocessor/Hyperthread systems as time consuming tasks like filtering packets are single threaded. No rule is without exception: during an "Update list of packets in real time" capture, capturing traffic runs in one process and dissecting and displaying packets runs in another process - which should benefit from two processors.

1.2.2. Microsoft Windows

  • Windows 2000, XP Home, XP Pro, XP Tablet PC, XP Media Center, Server 2003 or Vista (XP Pro recommended)

  • 32-bit Pentium or alike (recommended: 400MHz or greater), 64-bit processors in WoW64 emulation - see remarks below

  • 128MB RAM system memory (recommended: 256MBytes or more)

  • 75MB available disk space (plus size of user's capture files, e.g. 100MB extra)

  • 800*600 (1280*1024 or higher recommended) resolution with at least 65536 (16bit) colors (256 colors should work if Wireshark is installed with the "legacy GTK1" selection of the Wireshark 1.0.x releases)

  • A supported network card for capturing:

Remarks:

  • Older Windows versions are no longer supported because of three reasons: None of the developers actively use those systems any longer which makes support difficult. The libraries Wireshark depends on (GTK, WinPCap, ...) are also dropping support for these systems. Microsoft also dropped support for these systems.

  • Windows 95, 98 and ME will no longer work with Wireshark. The last known version to work was Ethereal 0.99.0 (which includes WinPcap 3.1). You can get it from http://ethereal.com/download.html. According to this bug report, you may need to install Ethereal 0.10.0 on some systems. BTW: Microsoft no longer supports 98/ME since July 11, 2006!

  • Windows NT 4.0 will no longer work with Wireshark. The last known version to work was Wireshark 0.99.4 (which includes WinPcap 3.1), you still can get it from: http://prdownloads.sourceforge.net/wireshark/wireshark-setup-0.99.4.exe. BTW: Microsoft no longer supports NT 4.0 since December 31, 2005!

  • Windows CE and the embedded (NT/XP) versions are not supported!

  • 64-bit processors run Wireshark in 32 bit emulation (called WoW64), at least WinPcap 4.0 is required for that

  • Multi monitor setups are supported but may behave a bit strangely

1.2.3. Unix / Linux

Wireshark currently runs on most UNIX platforms. The system requirements should be comparable to the Windows values listed above.

Binary packages are available for at least the following platforms:

  • Apple Mac OS X

  • Debian GNU/Linux

  • FreeBSD

  • Gentoo Linux

  • HP-UX

  • Mandriva Linux

  • NetBSD

  • OpenPKG

  • Red Hat Fedora/Enterprise Linux

  • rPath Linux

  • Sun Solaris/i386

  • Sun Solaris/Sparc

If a binary package is not available for your platform, you should download the source and try to build it. Please report your experiences to wireshark-dev[AT]wireshark.org .