Yes, Wireshark is completely free. It's open source software released under the GNU General Public License version 2, there's no licence fee, and the download is the full version rather than a demo. You can also use it at work to analyse your company's or your customers' networks.
Wireshark's own FAQ is refreshingly blunt about this, and it even warns people who paid for a copy on eBay. There's one licensing detail that does matter for businesses on Windows, though, and it isn't about Wireshark itself. Here's the full picture, checked as of October 2026.
What Wireshark's own FAQ says about cost
The Wireshark FAQ says it's free software you can download without paying any licence fee, and that the version you download isn't a demo with limitations, it's the full version. It runs on Windows, macOS, Linux and UNIX.
If you paid someone for a copy, the FAQ asks whether they gave you anything extra, such as installation support, training or trace file analysis. If they didn't, you paid for something that's free to anyone at any time from the official site.
| Question | Wireshark's answer |
|---|---|
| Licence fee | None |
| Demo or full version | Full version |
| Licence | GNU General Public License version 2 |
| Use at a company | Yes, to capture and analyse your company's or customers' traffic |
| Ship it inside your own product | Allowed, but the GPL sets conditions on your product |
In plain terms, Wireshark lets you see the individual packets moving across a network, which is how you track down a slow connection, a misbehaving device or a service talking to somewhere it shouldn't. Paid network tools exist, but for packet-level digging this free one is the standard most of them get compared against.
Using Wireshark at work versus inside a product
The FAQ splits commercial use into two cases. If you work for a company and want to capture and analyse traffic on its networks or a customer's network, the answer is yes. If you want to build Wireshark into a product you sell, that's covered by the GPL, which places conditions on using GPL code in your own products. That's a job for your developer or lawyer, not a reason to avoid Wireshark.
The Npcap catch for Windows users
This is the detail most people never see. On Windows, Wireshark uses a capture driver called Npcap, which has its own licence. Npcap's site says the free version may be used, but not externally redistributed, on up to 5 systems.
Npcap's OEM page says the same: the free licence allows only five installs, with a few exceptions. For more, it sells Npcap OEM internal-use licences, with options from 100 seats to unlimited installs, and redistribution licences for software publishers. Only Npcap OEM provides a silent installer for unattended rollouts.
So Wireshark itself is free on every machine. But if your IT team wants to put it on dozens of Windows laptops, check the Npcap side first.
What Npcap adds for Wireshark on Windows
Npcap isn't only a licence question. It's the piece that makes some captures possible at all on Windows, and Npcap's site lists what it brings:
- Loopback capture through an adapter called NPF_Loopback, so you can see traffic between programs on the same machine.
- Raw 802.11 wireless capture in monitor mode, which Wireshark supports directly.
- An option to restrict packet sniffing to Administrators only.
- Support for Windows 7 and later, replacing the old WinPcap library, which is now discontinued.
That admin-only option is the setting I'd switch on for a shared work PC. Nobody without admin rights can then sniff traffic on that machine.
Older Windows versions
Wireshark's FAQ explains that each release branch supports the Windows versions that were still in Microsoft's lifecycle when the .0 release came out. Its example: Wireshark 3.2.0 came out in December 2019, just before Windows 7 reached end of extended support in January 2020, so every 3.2 release supports Windows 7. On an old machine, pick an older branch rather than paying for a 'compatible' copy elsewhere.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
How to get Wireshark for free safely
- Download Wireshark only from the official Wireshark site, never a reseller.
- On Windows, let the installer add Npcap, which Wireshark needs to capture packets.
- On Linux, check whether your distribution splits the packages. The FAQ says some ship the command-line tools separately from the graphical app, often called wireshark-qt.
- Start a capture on the interface you want to watch.
- Remember that on a switched network you may only see traffic to and from your own machine, which is normal rather than a fault.
Looking at other network and security tools? Browse our IT and network tool lists.
My verdict: should you pay anyone for Wireshark?
Wireshark is one of the rare tools where the free version is the only version. Use it, at home or at work, without worrying about a trial running out. The only licence to watch is Npcap if you're rolling it out across lots of Windows machines. If you need ongoing monitoring rather than packet-level digging, my guide to the best network monitoring software covers dashboards and alerts, and I've also covered WireGuard vs OpenVPN for securing the traffic you're inspecting.
Frequently asked questions
Is Wireshark free for commercial use?
Yes. Wireshark's FAQ says you can use it at a commercial organisation to capture and analyse traffic on your company's or customers' networks. Building it into a product you sell is governed by the GPL.
Is there a paid version of Wireshark?
No. Wireshark's FAQ says the version you download isn't a demo, it's the full version, with no licence fee.
What licence is Wireshark released under?
Wireshark is released under the GNU General Public License version 2.
I paid for Wireshark on eBay. Was I ripped off?
Probably. Wireshark's FAQ says it's available free to anyone at any time, so a paid copy only makes sense if the seller added something such as installation support or training.
Is Npcap free?
Npcap's free version may be used, but not externally redistributed, on up to 5 systems. Larger rollouts and redistribution need an Npcap OEM licence.
Why can I only see my own traffic in Wireshark?
On a switched network, unicast traffic between two other ports won't necessarily reach your port, so you mostly see packets to and from your own machine. That's how switches work, not a Wireshark limit.
Does Wireshark work on a Mac?
Yes. Wireshark's FAQ lists Windows, macOS, Linux and UNIX among its platforms.
