# 使用 Homebrew, apk, chocolatey, apt, dnf, Nix, zypper, scoop, winget 安装 wireshark 查看 wireshark 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:wireshark ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install wireshark ``` 证据: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add wireshark ``` 证据: Alpine Linux edge package indexes: wireshark from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install wireshark ``` 证据: Debian stable package indexes: wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install wireshark ``` 证据: Fedora Rawhide package metadata: wireshark from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/210a2053c8e007daf9ae39c2a21daaed9b2ddd07d63ecffa597050361e73650c-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#wireshark ``` 证据: nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install wireshark ``` 证据: openSUSE Tumbleweed package metadata: wireshark from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install wireshark ``` 证据: Chocolatey community package catalog: wireshark from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','windowsrepair' - Scoop (92%): ```sh scoop install extras/wireshark ``` 证据: Scoop official bucket manifest trees: bucket/wireshark.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id WiresharkFoundation.Wireshark -e ``` 证据: Windows Package Manager source index: WiresharkFoundation.Wireshark from https://cdn.winget.microsoft.com/cache/source.msix ## 软件包事实 - **软件包键:** brew:wireshark - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 4.6.7 - **来源摘要:** Network analyzer and capture tool - without graphical user interface - **主页:** - **上游文档:** - **许可证:** GPL-2.0-or-later - **源码归档:** - **最后更新:** 2026-07-09T02:07:19Z - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - capinfos (cli) - captype (cli) - dftest (cli) - dumpcap (cli) - editcap (cli) - idl2wrs (cli) - mergecap (cli) - mmdbresolve (cli) - randpkt (cli) - rawshark (cli) - reordercap (cli) - sharkd (cli) - text2pcap (cli) - tshark (cli) - capinfos (别名) - captype (别名) - dftest (别名) - dumpcap (别名) - editcap (别名) - idl2wrs (别名) - mergecap (别名) - mmdbresolve (别名) - randpkt (别名) - rawshark (别名) - reordercap (别名) - sharkd (别名) - text2pcap (别名) - tshark (别名) ## 依赖 - c-ares - glib - gnutls - libgcrypt - libgpg-error - libmaxminddb - libnghttp2 - libnghttp3 - libsmi - libssh - lua - lz4 - pcre2 - speexdsp - zstd ## 构建依赖 - cmake ## macOS 提供的库 - krb5 - libpcap - libxml2 ## 安装行为 - post-install 钩子: 未定义 - 注意事项: This formula only installs the command-line utilities by default. Install Wireshark.app with Homebrew Cask: brew install wireshark-app If your list of available capture interfaces is empty (default macOS behavior), install ChmodBPF: brew install --cask wireshark-chmodbpf - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 4.6.7 - 管理器更新时间: 2026-07-09 - 本地数据: OK - 上游仓库: https://www.wireshark.org - 信息: Release/tag comparison is only available for GitHub repositories. ## 项目历史与用法 Wireshark is the canonical open-source network protocol analyzer, with command-line tools such as TShark, dumpcap, editcap, mergecap, and text2pcap packaged alongside the graphical analyzer in the broader project. The Homebrew package represented here is especially relevant to CLI packet-capture and capture-file workflows. ### 项目历史 Gerald Combs began writing the project in late 1997 under the name Ethereal because he needed a tool to troubleshoot network problems and wanted to learn more about networking. After development pauses, Ethereal 0.2.0 was released in July 1998, and patches, bug reports, encouragement, and protocol dissectors quickly followed. The project's extension model and community culture formed early. Contributors often arrived because they needed Wireshark to understand a protocol it did not yet dissect, copied an existing dissector, and sent the new code back. That pattern helped turn the tool into a broad protocol-analysis workbench rather than a single-vendor network sniffer. In 2006 the project moved and reappeared as Wireshark after the Ethereal trademark stayed with Combs's former employer. The official announcement presented Wireshark as the new home for the world's popular network protocol analyzer, while the migration page encouraged Ethereal users to move forward under the new name. Wireshark 1.0 arrived in 2008 after ten years of development and coincided with the first SharkFest developer and user conference. Wireshark 2.0 followed in 2015 with a major Qt-based user interface rewrite, and in 2023 the Wireshark Foundation was announced as a 501(c)(3) nonprofit home for the project, SharkFest, development support, and analysis education. ### 采用历史 Wireshark's adoption was driven by a simple economic and practical fact: professional protocol analyzers were once expensive, while tcpdump-like tools were powerful but not visual. Wireshark gave network engineers, security practitioners, developers, students, and educators an open-source way to capture, inspect, filter, and explain packets across many protocols. The project became standard vocabulary in networking and security. The official FAQ describes Wireshark as the world's most popular tool of its kind, used by network professionals, security experts, developers, and educators on Windows, macOS, Linux, and Unix-like systems. Its command-line sibling TShark made the same dissector knowledge useful in scripts, servers, labs, and CI jobs. ### 使用方式 Wireshark is used to capture live traffic, open saved capture files, decode protocol fields, apply display filters, inspect conversations, troubleshoot network behavior, develop protocols, teach packet structure, and investigate suspicious traffic. It relies on packet-capture libraries and formats such as pcap and pcapng, which also connect it to tcpdump and many other capture tools. TShark is the terminal version for capturing or reading packets and printing decoded output or writing captures. The surrounding command-line tools support package-nerd workflows: `dumpcap` captures with reduced privilege, `mergecap` combines files, `editcap` slices or transforms captures, `text2pcap` converts textual packet dumps, and `capinfos` reports metadata. ### 为什么软件包爱好者会关心 Wireshark is one of the rare packages that is both a desktop application and an infrastructure debugging primitive. Even users who never launch the GUI may install it for TShark and the capture-file utilities because they encode Wireshark's protocol knowledge in scriptable tools. Its history also explains why distributions care about privilege separation and packaging details: packet capture may require elevated rights, but protocol dissection is a large attack surface. The split between capture helpers and analysis processes is part of the tool's operational culture, not just an implementation detail. ### 时间线 - 1997: Gerald Combs starts Ethereal to troubleshoot networks and learn networking. - 1998: Ethereal 0.2.0 is publicly released in July. - 2006: The project changes name from Ethereal to Wireshark. - 2008: Wireshark 1.0 is released and the first SharkFest conference is held. - 2015: Wireshark 2.0 ships with a new Qt-based user interface. - 2023: The Wireshark Foundation is announced as a nonprofit home for Wireshark and SharkFest. ### Related projects - TShark is the command-line network protocol analyzer distributed with Wireshark. - tcpdump, libpcap, Npcap, and WinPcap are adjacent capture tools and libraries in the same packet-analysis ecosystem. - Stratoshark later extended Wireshark-style inspection ideas toward cloud forensics under the Wireshark Foundation umbrella. ### 来源 - - - - - - - ## 安全说明 packet capture and network inspection tool. - **Geiger 风险:** red / 高 - packet capture and network inspection tool ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: $XDG_CONFIG_HOME/wireshark/preferences, ~/.config/wireshark/preferences, ~/.wireshark/preferences - Windows: %APPDATA%\Wireshark\preferences, %USERPROFILE%\Application Data\Wireshark\preferences ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** wireshark - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 其他软件包管理器记录 - Debian apt - libwireshark-data - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-data from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- data files | https://www.wireshark.org/ - Debian apt - libwireshark-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- development files | https://www.wireshark.org/ - Debian apt - libwireshark18 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark18 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- shared library | https://www.wireshark.org/ - Debian apt - libwiretap-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- development files | https://www.wireshark.org/ - Debian apt - libwiretap15 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap15 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- shared library | https://www.wireshark.org/ - Debian apt - libwsutil-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- development files | https://www.wireshark.org/ - Debian apt - libwsutil16 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil16 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- shared library | https://www.wireshark.org/ - Debian apt - tshark - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: tshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - console version | https://www.wireshark.org/ - Debian apt - wireshark - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - graphical interface | https://www.wireshark.org/ - Debian apt - wireshark-common - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-common from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - common files | https://www.wireshark.org/ - Debian apt - wireshark-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - development tools | https://www.wireshark.org/ - Debian apt - wireshark-doc - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - documentation | https://www.wireshark.org/ - Nix - wireshark: normalized package name match | nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - libwireshark-data - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-data from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- data files | https://www.wireshark.org/ - Ubuntu apt - libwireshark-dev - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- development files | https://www.wireshark.org/ - Ubuntu apt - libwireshark17t64 - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark17t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- shared library | https://www.wireshark.org/ ## 相关链接 - [Secret-risk packages](https://pkg.so/zh-hans/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/zh-hans/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://pkg.so/zh-hans/brew-utility-packages/) - Matched Homebrew package provider. - [zstd](https://pkg.so/zh-hans/brew/zstd/) - Runtime dependency declared by Homebrew. - [glib](https://pkg.so/zh-hans/brew/glib/) - Runtime dependency declared by Homebrew. - [pcre2](https://pkg.so/zh-hans/brew/pcre2/) - Runtime dependency declared by Homebrew. - [lz4](https://pkg.so/zh-hans/brew/lz4/) - Runtime dependency declared by Homebrew. - [gnutls](https://pkg.so/zh-hans/brew/gnutls/) - Runtime dependency declared by Homebrew. - [c-ares](https://pkg.so/zh-hans/brew/c-ares/) - Runtime dependency declared by Homebrew. - [cmake](https://pkg.so/zh-hans/brew/cmake/) - Build dependency declared by Homebrew. - [tcpflow](https://pkg.so/zh-hans/brew/tcpflow/) - Shares pkgdb curated category or tags: cli, networking, packet-capture, protocol-analysis. - [libpcap](https://pkg.so/zh-hans/brew/libpcap/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [tcpdump](https://pkg.so/zh-hans/brew/tcpdump/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [arping](https://pkg.so/zh-hans/brew/arping/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [sngrep](https://pkg.so/zh-hans/brew/sngrep/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [netwatch](https://pkg.so/zh-hans/brew/netwatch/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [yaf](https://pkg.so/zh-hans/brew/yaf/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [packetry](https://pkg.so/zh-hans/brew/packetry/) - Shares pkgdb curated category or tags: cli, networking, protocol-analysis. - [wireshark-app](https://pkg.so/zh-hans/cask/wireshark-app/) - Executable or command metadata overlaps with this package. Shared terms: analyzer, capinfos, captype, dftest, dumpcap. - [weechat](https://pkg.so/zh-hans/brew/weechat/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, error, gnutls, libgcrypt, libgpg. ## Combined YAML source View the package source record on GitHub. [combined/wireshark.yml](https://github.com/mxcl/pkgdb/blob/main/combined/wireshark.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph