64-bit
nullsoftmachine scope2.na.dl.wireshark.org · publisher-owned- File name
- Wireshark-4.6.8-x64.exe
- SHA-256
- 8eba737cb6875d9b3709228d37893f71125bdc50d7148e24d9cdc755259e9c3a
- Product code
- Wireshark
by The Wireshark developer community, https://www.wireshark.org · GPL-2.0
The world's most popular network protocol analyzer.
These URLs are the ones The Wireshark developer community, https://www.wireshark.org declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what The Wireshark developer community, https://www.wireshark.org published. Delete it.
Windows · PowerShell
Get-FileHash "Wireshark-4.6.8-x64.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "Wireshark-4.6.8-x64.exe"Expected output
8eba737cb6875d9b3709228d37893f71125bdc50d7148e24d9cdc755259e9c3a
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "Wireshark-4.6.8-x64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 64-bit
{44623207-AC43-4DED-B865-92626BD36E4F}
Uninstall, with the usual prompts
msiexec /x {44623207-AC43-4DED-B865-92626BD36E4F}Silent, for deployment
msiexec /x {44623207-AC43-4DED-B865-92626BD36E4F} /qn /norestartThe codes above belong to Wireshark 4.6.8, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "Wireshark*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Wireshark registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from wireshark.org, which is a domain we have tied to The Wireshark developer community, https://www.wireshark.org.
Every one of the 3 installers on this page comes with the SHA-256 The Wireshark developer community, https://www.wireshark.org declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id WiresharkFoundation.Wireshark --exactUpgrade later
winget upgrade --id WiresharkFoundation.WiresharkWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Wireshark, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
E67CFC2B4462CCE93AECB67972D5079E85B8FE575FB18858F9260B6EC7B37258
ACEF04C9A80E30C7197B6B3E405DAEA95191C9BFD92268CEE395C20C2C5E24FF
CA156A40791ED9803E6028A413FE05EC22D723B09AC5F727534EDE3F5F1D0423
AB28D13695ACE992307FB1AAEA7144F977D5B6562ACEC1F465C9C0A9FA04190C
B9383E52BAEBBB4CAA10BC9F6977771E6528EB3AC40EB70083E7C1A83BDC243B
90104F6EAE9B1FB4B1C8EBF6313D73E42F34EE274D3BC26BDC86741D47466C9D
3C3A2F020D5E053514EEFA30DDE49E596B857EDEF6971B655BDFD09AF504B0F6
8231F23309229F3A18D7087858098A73B3A76595A672F8B3F0E678351E78E89A
4E10774E14132A8507163D43FAD98A61AA52D8EADA00FA85AE717B3494623CBE
102017D8E99A75B57895CD2144E6A61DC335A8FF14C7A25BD83A55F8EA9AD77B
62A0D34EFB4418FE373B8F56A13457FF488C827D8C7D7F48E3037E52752BEE6F
E233387DEEAC2693CD9EDC73A9A1578338AE211669F01F5DFB99A119A4F5FF9A
09DB2E7365B8DC56BC293B5E2849D9D06EBD8411F5A5E72E528964FBB051F283
C9578CEF62C7614824679C6025C10A033DDB2E56347EF4F6C1A7FCE6F4E28563
59B5AC08EFC1BD595064B942D33C0AE63E4343DB063FD388CE69BDD42285F542
373A93E9B5FFA3559938424A2AABD3338786CFF7BEF084641C2C5E5BFB44325E
ED0F03CC3D4A0815731CA3C8531A5EC05E5A0D965A2C868D1D4C995D025F3758
FA979913B8CACEAEC071156B50BE0B4A999BB0C21D29F05E1A8EE61ED90C1B45
5D250C1DFBACC697FA4A219A8E11F6C3050173954A2C8CEC7FB223362DFD2E26
95152FA140F4AD58FCA8C0C728805B9DE0015951E4DB025276534A04581D52EC
60EA15809F7138421A7EC1AE4EA7FCBFA5B398BFD2D9A5ED96D0563A591F99E3
AAEC7ABD3B79E0F336722AB86B193BBF5175FED125D7B8E2629CCDFC9A763AA1
92E040F3C9B158743B29D349BB6E3DDB9D5E5BF18DBB97A657CD5E7EEDD72343
2747EC671D9C0434FFEB12CFE89EC9A0733A6712693EA73701E6CE6ADB2551A1
66A42718A940AF6CCE058DDBB2C529C65D5157B889E9A17AD9D9A89814DE080E
559A09B22F47AFAD45898369B0C21C73921F9B855BCC0FEA9C6E06F63B1245EB
02C3064187E443B79308CEA88CA649C70D9CB85ADFDD34E5250933763E2D8B29
8E31AA3DEDA2708887C732DED9B984A9771C7254A257274BBBB8DABD4959DF4E
0E0F5B593A07BB86B2910E009FAFC7704592749140EE9E2C6CD3B790D919A10D
C4C18FB334A4983DE71D1C849974A820624D54E3E273C9B7398DF02EF691DBD5
2E33FBDA09CBC697A293FAEBA8A4FE4C2FCFC57DB7CCF6421EC1F2C05223E6AC
0CF111154D7234983EF08BA6D25447A2AA019F1E033E1505F7CFF90F38BDB0F5
6A6DB09CB77689ADFF86AE5AF2FB783573778C01644F61D39DE28789AE71A765
D1925B045300C34EA8082B7EC0D79AEAE31EDF01EB9FDD9B69E069ECE785CA93
50F080CC9A8A58B0B6EA881749B90F0CB3308360C346B5249AE89324581C31B7
5B13C415D412704FE6AC66B961378E4BAF03060729FB0FD757C03E57DCB1B9FA
2DFDD1116D1F2C5A916A223B3E421F43FD15A6D2FDB7E2BE23CE280D2062E19F
3757A95F945239E927FCC8226E3F7B12ECBE1A3BAE4905A152C3F6D4F9E856A4
F9E69893E72BD99495F7311DF11265DF64FB13E2536755915ACC0F0130958503
44524F1ABD1AC0F550E77516527D70A2AB4A1D88273947608E3200A42F792F2C
0726F0FE0ACB183EECE26927A455B16F367EE20DCB5215991EC30EA3D5A416E6
245A27B826B50C5B50F170A5B5A1F3F150CE1E35BCE7792F06F3F0ECECB34EA7
085D9AA4F6614730F132FB5C28EC5FA445DEA79687E4C648D586DE569FFCC5E2
965E532C05C4BE1423E72BCB6C3350ACA3F64B42543807C1193705AB7A1E59AF
8243E019D2BD73C81DE53C67DDB23D877ECEC2FC1699C9AA074CCAA2D7D9B267
74D4ED6C9AB093FCEBDFB034F4A0480C11774BFAC72B7B3271CDADC3098278A0
FE36DCDAC852268B63B4B12DA6E13001F3593F33CFB3C3EAF9872C3E6DFFEE76
7E05D013F33B21366B6D3663ACDB2143549E83704CA646737FE65298F244A381
D37CE2A48B42DF2B81D56D6D3C80A5B71B9602DA171F46C6C54F500250E1E1C1
9820C6F8CB42D0C10A83AC62E0125ED600855EEDF7EF5980535944DDA3B3BB60
2178ACDB1ABB5D9454EAAC59D99F1DF8D499ED56D97436E200DBB3267CBF663B
3164B91CC3F08268A795090C8478FCF80E741D3E620F06E8441E0F9D4418AC4F
9C2E5D1467547399EB08990B00FD48D84E5ADC788EAFE30AAF0333156C446B96
042732CD3A86688CC1B83B2F9473335E80280933634F74EFC8C277833FB46ABB
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Wireshark version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Not related to Wireshark — just other entries, each with its own official URL and published hash.