# Install wireshark with Homebrew, apk, chocolatey, apt, dnf, Nix, scoop, winget, zypper Network analyzer and capture tool - without graphical user interface. Version 4.6.6 via Homebrew; verified 2026-06-25. ## Install ```sh sudo av install brew:wireshark ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install wireshark ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add tshark ``` Evidence: Alpine Linux edge package indexes: tshark from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install libwireshark-data ``` Evidence: Debian stable package indexes: libwireshark-data from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install wireshark ``` Evidence: Fedora Rawhide package metadata: wireshark from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#wireshark ``` Evidence: nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install libwireshark19 ``` Evidence: openSUSE Tumbleweed package metadata: libwireshark19 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install wireshark ``` Evidence: Chocolatey community package catalog: wireshark from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','windows-sdk-10.1' - Scoop (92%): ```sh scoop install extras/wireshark ``` Evidence: Scoop official bucket manifest trees: bucket/wireshark.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id WiresharkFoundation.Wireshark -e ``` Evidence: Windows Package Manager source index: WiresharkFoundation.Wireshark from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:wireshark - **Package manager:** Homebrew - **Package manager page:** - **Version:** 4.6.6 - **Source summary:** Network analyzer and capture tool - without graphical user interface - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-or-later - **Source archive:** - **Last updated:** 2026-06-25T13:38:12+02:00 - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - capinfos (cli) - captype (cli) - dftest (cli) - dumpcap (cli) - editcap (cli) - idl2wrs (cli) - mergecap (cli) - mmdbresolve (cli) - randpkt (cli) - rawshark (cli) - reordercap (cli) - sharkd (cli) - text2pcap (cli) - tshark (cli) - capinfos (alias) - captype (alias) - dftest (alias) - dumpcap (alias) - editcap (alias) - idl2wrs (alias) - mergecap (alias) - mmdbresolve (alias) - randpkt (alias) - rawshark (alias) - reordercap (alias) - sharkd (alias) - text2pcap (alias) - tshark (alias) ## Dependencies - c-ares - glib - gnutls - libgcrypt - libgpg-error - libmaxminddb - libnghttp2 - libnghttp3 - libsmi - libssh - lua - lz4 - pcre2 - speexdsp - zstd ## Build dependencies - cmake ## Uses from macOS - krb5 - libpcap - libxml2 ## Install behavior - Post-install hook: not defined - Caveats: This formula only installs the command-line utilities by default. Install Wireshark.app with Homebrew Cask: brew install wireshark-app If your list of available capture interfaces is empty (default macOS behavior), install ChmodBPF: brew install --cask wireshark-chmodbpf - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 4.6.6 - Package-manager updated: 2026-06-25 - Local data: ok - Upstream repository: https://www.wireshark.org - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Wireshark is the canonical open-source network protocol analyzer, with command-line tools such as TShark, dumpcap, editcap, mergecap, and text2pcap packaged alongside the graphical analyzer in the broader project. The Homebrew package represented here is especially relevant to CLI packet-capture and capture-file workflows. ### Project history Gerald Combs began writing the project in late 1997 under the name Ethereal because he needed a tool to troubleshoot network problems and wanted to learn more about networking. After development pauses, Ethereal 0.2.0 was released in July 1998, and patches, bug reports, encouragement, and protocol dissectors quickly followed. The project's extension model and community culture formed early. Contributors often arrived because they needed Wireshark to understand a protocol it did not yet dissect, copied an existing dissector, and sent the new code back. That pattern helped turn the tool into a broad protocol-analysis workbench rather than a single-vendor network sniffer. In 2006 the project moved and reappeared as Wireshark after the Ethereal trademark stayed with Combs's former employer. The official announcement presented Wireshark as the new home for the world's popular network protocol analyzer, while the migration page encouraged Ethereal users to move forward under the new name. Wireshark 1.0 arrived in 2008 after ten years of development and coincided with the first SharkFest developer and user conference. Wireshark 2.0 followed in 2015 with a major Qt-based user interface rewrite, and in 2023 the Wireshark Foundation was announced as a 501(c)(3) nonprofit home for the project, SharkFest, development support, and analysis education. ### Adoption history Wireshark's adoption was driven by a simple economic and practical fact: professional protocol analyzers were once expensive, while tcpdump-like tools were powerful but not visual. Wireshark gave network engineers, security practitioners, developers, students, and educators an open-source way to capture, inspect, filter, and explain packets across many protocols. The project became standard vocabulary in networking and security. The official FAQ describes Wireshark as the world's most popular tool of its kind, used by network professionals, security experts, developers, and educators on Windows, macOS, Linux, and Unix-like systems. Its command-line sibling TShark made the same dissector knowledge useful in scripts, servers, labs, and CI jobs. ### How it is used Wireshark is used to capture live traffic, open saved capture files, decode protocol fields, apply display filters, inspect conversations, troubleshoot network behavior, develop protocols, teach packet structure, and investigate suspicious traffic. It relies on packet-capture libraries and formats such as pcap and pcapng, which also connect it to tcpdump and many other capture tools. TShark is the terminal version for capturing or reading packets and printing decoded output or writing captures. The surrounding command-line tools support package-nerd workflows: `dumpcap` captures with reduced privilege, `mergecap` combines files, `editcap` slices or transforms captures, `text2pcap` converts textual packet dumps, and `capinfos` reports metadata. ### Why package nerds care Wireshark is one of the rare packages that is both a desktop application and an infrastructure debugging primitive. Even users who never launch the GUI may install it for TShark and the capture-file utilities because they encode Wireshark's protocol knowledge in scriptable tools. Its history also explains why distributions care about privilege separation and packaging details: packet capture may require elevated rights, but protocol dissection is a large attack surface. The split between capture helpers and analysis processes is part of the tool's operational culture, not just an implementation detail. ### Timeline - 1997: Gerald Combs starts Ethereal to troubleshoot networks and learn networking. - 1998: Ethereal 0.2.0 is publicly released in July. - 2006: The project changes name from Ethereal to Wireshark. - 2008: Wireshark 1.0 is released and the first SharkFest conference is held. - 2015: Wireshark 2.0 ships with a new Qt-based user interface. - 2023: The Wireshark Foundation is announced as a nonprofit home for Wireshark and SharkFest. ### Related projects - TShark is the command-line network protocol analyzer distributed with Wireshark. - tcpdump, libpcap, Npcap, and WinPcap are adjacent capture tools and libraries in the same packet-analysis ecosystem. - Stratoshark later extended Wireshark-style inspection ideas toward cloud forensics under the Wireshark Foundation umbrella. ### Sources - - - - - - - ## Security Notes packet capture and network inspection tool. - **Geiger risk:** red / high - packet capture and network inspection tool ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: $XDG_CONFIG_HOME/wireshark/preferences, ~/.config/wireshark/preferences, ~/.wireshark/preferences - Windows: %APPDATA%\Wireshark\preferences, %USERPROFILE%\Application Data\Wireshark\preferences ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** wireshark - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - libwireshark-data - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-data from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- data files | https://www.wireshark.org/ - Debian apt - libwireshark-dev - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- development files | https://www.wireshark.org/ - Debian apt - libwireshark18 - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark18 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- shared library | https://www.wireshark.org/ - Debian apt - libwiretap-dev - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- development files | https://www.wireshark.org/ - Debian apt - libwiretap15 - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap15 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- shared library | https://www.wireshark.org/ - Debian apt - libwsutil-dev - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- development files | https://www.wireshark.org/ - Debian apt - libwsutil16 - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil16 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- shared library | https://www.wireshark.org/ - Debian apt - tshark - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: tshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - console version | https://www.wireshark.org/ - Debian apt - wireshark - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - graphical interface | https://www.wireshark.org/ - Debian apt - wireshark-common - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-common from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - common files | https://www.wireshark.org/ - Debian apt - wireshark-dev - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - development tools | https://www.wireshark.org/ - Debian apt - wireshark-doc - 4.4.15-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - documentation | https://www.wireshark.org/ - Nix - wireshark: normalized package name match | nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - libwireshark-data - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-data from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- data files | https://www.wireshark.org/ - Ubuntu apt - libwireshark-dev - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- development files | https://www.wireshark.org/ - Ubuntu apt - libwireshark17t64 - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark17t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- shared library | https://www.wireshark.org/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [c-ares](https://www.automicvault.com/pkg/brew/c-ares/) - Runtime dependency declared by Homebrew. - [glib](https://www.automicvault.com/pkg/brew/glib/) - Runtime dependency declared by Homebrew. - [gnutls](https://www.automicvault.com/pkg/brew/gnutls/) - Runtime dependency declared by Homebrew. - [libgcrypt](https://www.automicvault.com/pkg/brew/libgcrypt/) - Runtime dependency declared by Homebrew. - [libgpg-error](https://www.automicvault.com/pkg/brew/libgpg-error/) - Runtime dependency declared by Homebrew. - [libmaxminddb](https://www.automicvault.com/pkg/brew/libmaxminddb/) - Runtime dependency declared by Homebrew. - [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew. - [tcpflow](https://www.automicvault.com/pkg/brew/tcpflow/) - Shares av.db curated category or tags: cli, networking, packet-capture, protocol-analysis. - [daemonlogger](https://www.automicvault.com/pkg/brew/daemonlogger/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [dhcpdump](https://www.automicvault.com/pkg/brew/dhcpdump/) - Shares av.db curated category or tags: cli, network-debugging, networking. - [dnstop](https://www.automicvault.com/pkg/brew/dnstop/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [libpcap](https://www.automicvault.com/pkg/brew/libpcap/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [packetry](https://www.automicvault.com/pkg/brew/packetry/) - Shares av.db curated category or tags: cli, networking, protocol-analysis. - [pcapmirror](https://www.automicvault.com/pkg/brew/pcapmirror/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [wireshark-app](https://www.automicvault.com/pkg/cask/wireshark-app/) - Executable or command metadata overlaps with this package. Shared terms: analyzer, capinfos, captype, dftest, dumpcap. - [wget2](https://www.automicvault.com/pkg/brew/wget2/) - Local package facts share a topical domain. Shared terms: cli, gnutls, libnghttp2, networking, pcre2. - [gsasl](https://www.automicvault.com/pkg/brew/gsasl/) - Local package facts share a topical domain. Shared terms: cli, interface, libgcrypt, networking. ## Combined YAML source View the package source record on GitHub. [combined/wireshark.yml](https://github.com/automic-vault/db/blob/main/combined/wireshark.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph