# 使用 Homebrew, apk, chocolatey, apt, dnf, Nix, zypper, scoop, winget 安装 wireshark

查看 wireshark 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:wireshark
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install wireshark
```

  证据: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add wireshark
```

  证据: Alpine Linux edge package indexes: wireshark from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install wireshark
```

  证据: Debian stable package indexes: wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install wireshark
```

  证据: Fedora Rawhide package metadata: wireshark from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#wireshark
```

  证据: nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- zypper (92%):

```sh
sudo zypper install wireshark
```

  证据: openSUSE Tumbleweed package metadata: wireshark from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install wireshark
```

  证据: Chocolatey community package catalog: wireshark from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','windowsrepair'

- Scoop (92%):

```sh
scoop install extras/wireshark
```

  证据: Scoop official bucket manifest trees: bucket/wireshark.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1

- winget (92%):

```sh
winget install --id WiresharkFoundation.Wireshark -e
```

  证据: Windows Package Manager source index: WiresharkFoundation.Wireshark from https://cdn.winget.microsoft.com/cache/source.msix

## 软件包事实

- **软件包键:** brew:wireshark
- **软件包管理器:** Homebrew
- **版本:** 4.6.7
- **来源摘要:** Network analyzer and capture tool - without graphical user interface
- **主页:** <https://www.wireshark.org>
- **最后更新:** 2026-07-09T02:07:19Z
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- capinfos (别名)
- captype (别名)
- dftest (别名)
- dumpcap (别名)
- editcap (别名)
- idl2wrs (别名)
- mergecap (别名)
- mmdbresolve (别名)
- randpkt (别名)
- rawshark (别名)
- reordercap (别名)
- sharkd (别名)
- text2pcap (别名)
- tshark (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 4.6.7
## 项目历史与用法

Wireshark is the canonical open-source network protocol analyzer, with command-line tools such as TShark, dumpcap, editcap, mergecap, and text2pcap packaged alongside the graphical analyzer in the broader project. The Homebrew package represented here is especially relevant to CLI packet-capture and capture-file workflows.

### 项目历史

Gerald Combs began writing the project in late 1997 under the name Ethereal because he needed a tool to troubleshoot network problems and wanted to learn more about networking. After development pauses, Ethereal 0.2.0 was released in July 1998, and patches, bug reports, encouragement, and protocol dissectors quickly followed.

The project's extension model and community culture formed early. Contributors often arrived because they needed Wireshark to understand a protocol it did not yet dissect, copied an existing dissector, and sent the new code back. That pattern helped turn the tool into a broad protocol-analysis workbench rather than a single-vendor network sniffer.

In 2006 the project moved and reappeared as Wireshark after the Ethereal trademark stayed with Combs's former employer. The official announcement presented Wireshark as the new home for the world's popular network protocol analyzer, while the migration page encouraged Ethereal users to move forward under the new name.

Wireshark 1.0 arrived in 2008 after ten years of development and coincided with the first SharkFest developer and user conference. Wireshark 2.0 followed in 2015 with a major Qt-based user interface rewrite, and in 2023 the Wireshark Foundation was announced as a 501(c)(3) nonprofit home for the project, SharkFest, development support, and analysis education.

### 采用历史

Wireshark's adoption was driven by a simple economic and practical fact: professional protocol analyzers were once expensive, while tcpdump-like tools were powerful but not visual. Wireshark gave network engineers, security practitioners, developers, students, and educators an open-source way to capture, inspect, filter, and explain packets across many protocols.

The project became standard vocabulary in networking and security. The official FAQ describes Wireshark as the world's most popular tool of its kind, used by network professionals, security experts, developers, and educators on Windows, macOS, Linux, and Unix-like systems. Its command-line sibling TShark made the same dissector knowledge useful in scripts, servers, labs, and CI jobs.

### 使用方式

Wireshark is used to capture live traffic, open saved capture files, decode protocol fields, apply display filters, inspect conversations, troubleshoot network behavior, develop protocols, teach packet structure, and investigate suspicious traffic. It relies on packet-capture libraries and formats such as pcap and pcapng, which also connect it to tcpdump and many other capture tools.

TShark is the terminal version for capturing or reading packets and printing decoded output or writing captures. The surrounding command-line tools support package-nerd workflows: `dumpcap` captures with reduced privilege, `mergecap` combines files, `editcap` slices or transforms captures, `text2pcap` converts textual packet dumps, and `capinfos` reports metadata.

### 为什么软件包爱好者会关心

Wireshark is one of the rare packages that is both a desktop application and an infrastructure debugging primitive. Even users who never launch the GUI may install it for TShark and the capture-file utilities because they encode Wireshark's protocol knowledge in scriptable tools.

Its history also explains why distributions care about privilege separation and packaging details: packet capture may require elevated rights, but protocol dissection is a large attack surface. The split between capture helpers and analysis processes is part of the tool's operational culture, not just an implementation detail.

### 时间线

- 1997: Gerald Combs starts Ethereal to troubleshoot networks and learn networking.
- 1998: Ethereal 0.2.0 is publicly released in July.
- 2006: The project changes name from Ethereal to Wireshark.
- 2008: Wireshark 1.0 is released and the first SharkFest conference is held.
- 2015: Wireshark 2.0 ships with a new Qt-based user interface.
- 2023: The Wireshark Foundation is announced as a nonprofit home for Wireshark and SharkFest.

### Related projects

- TShark is the command-line network protocol analyzer distributed with Wireshark.
- tcpdump, libpcap, Npcap, and WinPcap are adjacent capture tools and libraries in the same packet-analysis ecosystem.
- Stratoshark later extended Wireshark-style inspection ideas toward cloud forensics under the Wireshark Foundation umbrella.

### 来源

- <https://blog.wireshark.org/2015/11/let-me-tell-you-about-wireshark-2-0/>
- <https://blog.wireshark.org/2023/03/announcing-the-wireshark-foundation/>
- <https://www.wireshark.org/docs/man-pages/tshark.html>
- <https://www.wireshark.org/docs/wsug_html_chunked/ChIntroHistory.html>
- <https://www.wireshark.org/faq>
- <https://www.wireshark.org/migration>
- <https://www.wireshark.org/news/20060607.html>


## 安全说明

packet capture and network inspection tool.

- **Geiger 风险:** red / 高
- packet capture and network inspection tool


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: $XDG_CONFIG_HOME/wireshark/preferences, ~/.config/wireshark/preferences, ~/.wireshark/preferences
- Windows: %APPDATA%\Wireshark\preferences, %USERPROFILE%\Application Data\Wireshark\preferences
## 其他软件包管理器记录

- Debian apt - libwireshark-data - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-data from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- data files | https://www.wireshark.org/
- Debian apt - libwireshark-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- development files | https://www.wireshark.org/
- Debian apt - libwireshark18 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwireshark18 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection library -- shared library | https://www.wireshark.org/
- Debian apt - libwiretap-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- development files | https://www.wireshark.org/
- Debian apt - libwiretap15 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwiretap15 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet capture library -- shared library | https://www.wireshark.org/
- Debian apt - libwsutil-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- development files | https://www.wireshark.org/
- Debian apt - libwsutil16 - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: libwsutil16 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network packet dissection utilities library -- shared library | https://www.wireshark.org/
- Debian apt - tshark - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: tshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - console version | https://www.wireshark.org/
- Debian apt - wireshark - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - graphical interface | https://www.wireshark.org/
- Debian apt - wireshark-common - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-common from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - common files | https://www.wireshark.org/
- Debian apt - wireshark-dev - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - development tools | https://www.wireshark.org/
- Debian apt - wireshark-doc - 4.4.16-0+deb13u1: normalized package name match | Debian stable package indexes: wireshark-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | network traffic analyzer - documentation | https://www.wireshark.org/
- Nix - wireshark: normalized package name match | nixpkgs package indexes: pkgs/by-name/wi/wireshark/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - libwireshark-data - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-data from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- data files | https://www.wireshark.org/
- Ubuntu apt - libwireshark-dev - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- development files | https://www.wireshark.org/
- Ubuntu apt - libwireshark17t64 - 4.2.2-1.1build3: normalized package name match | Ubuntu 24.04 LTS package indexes: libwireshark17t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | network packet dissection library -- shared library | https://www.wireshark.org/


## Combined YAML source

View the package source record on GitHub. [combined/wireshark.yml](https://github.com/mxcl/pkgdb/blob/main/combined/wireshark.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph