Ask Your Question

how do I configure in read only mode?

asked 2022-12-28 16:59:11 +0000

cristo gravatar image

updated 2022-12-29 16:15:38 +0000

I need to configure Wireshark without capture capabilities or privileges. Only decode pcap files from tcpdump. I am looking for a virtual windows installation that requires administrator privileges to install. Can It be installed without Winpcap, npcap, and Usbcap to achieve this?

edit retag flag offensive close merge delete


Disable Capturing Capacity or Just to read the pcap files but no capture option
On what operating system?
Are you interested in compiling yourself and disabling/removing capture from the gui and cli options?

Chuckc gravatar imageChuckc ( 2022-12-28 22:59:30 +0000 )edit

Or remove the dumpcap program.

There is no run-time configure option for this.

Guy Harris gravatar imageGuy Harris ( 2022-12-29 08:52:36 +0000 )edit

On Windows you can use the portable version of Wireshark also -- no admin rights needed to install.

André gravatar imageAndré ( 2022-12-29 10:10:29 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2022-12-29 17:13:20 +0000

André gravatar image

For Windows, just run the installer but skip the installation of Npcap by unchecking the option. The option for USBcap is unchecked by default.

Alternatives: uninstall Npcap afterwards, remove dumpcap.exe or use the portable version.

See also Installing Wireshark under Windows, i.e. installer command line options.

edit flag offensive delete link more


The reason why this doesn't work on UN*Xes is that 1) libpcap is installed by default on most if not all UN*Xes on which Wireshark runs (Linux, *BSD, macOS, Solaris, possibly AIX) and 2) the capture mechanism libpcap uses on those systems is built into the operating system (unlike Windows, where Npcap has to install its own driver).

So there's no equivalent on other platforms. You'd have to manually remove the dumpcap program or rebuild Wireshark from source with packet capturing disabled.

Guy Harris gravatar imageGuy Harris ( 2022-12-30 04:09:51 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2022-12-28 16:59:11 +0000

Seen: 108 times

Last updated: Dec 29 '22