This is our old Q&A Site. Please post any new questions and answers at


Is there any way to use WireShark as a Protocol Analyzer only and disable the hability to "sniffing" the network?

My idea is to relase the software for some engeneer people here but I don't want then to grab new data, only to analyze "already captured data" for Wireshark.

Is that possible?

asked 28 Jan '13, 08:39

Bonacordi's gravatar image

accept rate: 0%

edited 28 Jan '13, 10:07

Don't install the actual traffic capture software, e.g. WinPCap for Windows. For other platforms you could either remove the capture software, e.g. lipcap on linux, or restrict their access to it.

permanent link

answered 28 Jan '13, 09:10

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Hey Grahamb, thanks for your answer... just wondering how I will be able to do that since I found in the Install Guide - Cap 2.8 - Session "Install WinPcap?" page that Wireshark installer contains the latest released WinPcap installer.

I couldn't test the install since I'm waiting a lab machine in order to test it in my company but I would like to ask, is this WinPcap like a checkbox during the install process?

(28 Jan '13, 10:05) Bonacordi

Based on your comments to grahamb regarding WinPcap, it looks like you're looking for a solution on the Windows platform. In that case, in theory you could compile and release your own installer without capture support, paying special attention to the following paragraph from config.nmake:

# Optional: WinPcap developer's pack to capture network traffic.
# If you have the WinPcap developer's pack (at least version 3.0),
# set this to the directory in which the WinPcap developer's pack resides.
# If you don't have the WPdpack, comment this line out, so that
# PCAP_DIR isn't defined.

Unfortunately, just commenting out PCAP_DIR doesn't actually work. And when I renamed the WpdPack directory, compilation failed as follows:

capture_if_details_dlg_win32.c(108) : fatal error C1083: Cannot open include file: 'Packet32.h': No such file or directory

So this looks like a bug that needs to be fixed first before this could be an option for you.

permanent link

answered 28 Jan '13, 10:45

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Jan '13, 08:39

question was seen: 2,953 times

last updated: 28 Jan '13, 10:45

p​o​w​e​r​e​d by O​S​Q​A