WireShark for Mac
Network protocol analyzer.
Free
In English
Version 4.6.6When you purchase through links on our site, we may earn an affiliate commission
WireShark overview
Wireshark is one of the world's foremost network protocol analyzers, and is the standard in many parts of the industry. It is the continuation of a project that started in 1998. Hundreds of developers around the world have contributed to it, and it it still under active development.
Wireshark has a rich feature set which includes the following:
- Standard three-pane packet browser
- Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
- Multi-interface: Along with a standard GUI, Wireshark includes TShark, a text-mode analyzer which is useful for remote capture, analysis, and scripting
- The most powerful display filters in the industry
- VoIP analysis
- Live capture and offline analysis are supported
- Read/write many different capture file formats: tcpdump (libpcap), NAI's Sniffer (compressed and uncompressed), Sniffer Pro, NetXray, Sun snoop and atmsnoop, Shomiti/Finisar Surveyor, AIX's iptrace, Microsoft's Network Monitor, Novell's LANalyzer, RADCOM's WAN/LAN Analyzer, HP-UX nettl, i4btrace from the ISDN4BSD project, Cisco Secure IDS iplog, the pppd log (pppdump-format), the AG Group's/WildPacket's EtherPeek/TokenPeek/AiroPeek, Visual Networks' Visual UpTime and many others
- Capture files compressed with gzip can be decompressed on the fly
- Hundreds of protocols are supported, with more being added all the time
- Coloring rules can be applied to the packet list, which eases analysis
What's new in version 4.6.6
Bug Fixes
The following vulnerabilities have been fixed:
- wnpa-sec-2026-51 ROHC protocol dissector crash. Issue 21243.
The following bugs have been fixed:
- Wireshark crashes when run under Visual Studio on Windows. Work item 24787.
- Welcome page slide preferences are now available in the preferences window.
- vwr: Read of uninitialized memory in pntoh16. Issue 16460.
- vwr: Read of uninitialized memory in find_signature. Issue 16461.
- Upgrades on Windows do not retain existing optional features unless explicitly requested, resulting in accidental removal of features. Issue 18925.
- Wireshark.exe version 4.6.5 is twice as large as version 4.6.4. Issue 21233.
- MACsec dissector global-buffer-overflow. Issue 21235.
- Wireshark 4.6.5 does not run on Windows 10 version 1809 (including Server 2019 and some LTSC versions) Issue 21237.
- Fuzz job issue: fuzz-2026-05-02-14184750352.pcap. Issue 21240.
- packet-bacapp: rename aurth-request to auth-request. Issue 21246.
- Fuzz job issue: randpkt-2026-05-10-14293434231.pcap. Issue 21253.
New and Updated Features
- The Windows installers now ship with Npcap 1.88. They previously shipped with Npcap 1.87.
New Protocol Support
There are no new protocols in this release.
Updated Protocol Support
BACapp, BPv7, DB/IB GDS DB, Kafka, MACsec, PFCP, RF4CE, ROHC, RTPS-VT, SAPHDB, and SIP
New and Updated Capture File Support
JSON and VeriWave
New and Updated File Format Decoding Support
There is no new or updated file format support in this release.
Plugin Development Changes
On UN*X systems (excluding macOS when running from an app bundle, as with the official installer) extcap binaries are now searched for under the libexec directory by default, e.g., /usr/libexec/wireshark/extcap instead of /usr/lib64/wireshark/extcap or similar. This is the customary place for helper binaries, which as opposed to libraries do not need multiarch support. The location can be overridden via the environment variable WIRESHARK_EXTCAP_DIR. The extcap binaries shipped with Wireshark are installed in the new location, but third party extcaps may need packaging changes. This change was effective in version 4.6.0, but was not explicitly noted in the release notes previously. Note that some distributions do not use a libexec directory, such as Alpine Linux, which does not have multilib support. On such systems extcap binaries should be in the same location as before.
WireShark for Mac
Free
In English
Version 4.6.6
Write a detailed review about WireShark
(30 Reviews of WireShark)
Comments
User Ratings
Feb 21, 2025
Version: 4.4.4
Version 4.4.4 requires MacOS 11 (Big Sur) or newer.
MacUpdate staff, please update.
Feb 20, 2025
Version: 4.2.11
v4.4.4 is out. Access it at the dev site. (The MU link is hitting a 404).
Oct 11, 2024
Version: 4.4.1
v4.4.1 ARM (Apple Silicon) version is at: https://2.na.dl.wireshark.org/osx/Wireshark%204.4.1%20Arm%2064.dmg
Jun 16, 2022
Version: 3.6.6
There is a native ARM version of Wireshark now as well. M1 & M2 Mac users need not bother with the Intel version. You'll find it at the Dev site: https://www.wireshark.org/download.html
Apr 15, 2022
Version: 3.6.3
ARM versions of Wireshark are now available. If you have an M1 series Mac, be sure to get the Wireshark macOS Arm 64-bit .dmg version! The general downloads page is here: https://www.wireshark.org/download.html
