This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Disable Capturing Capacity or Just to read the pcap files but no capture option

0

Hi

Is there any way to disable the capturimg feature on wire shark so that user can read only prevoiusly captured files but can not capture the packets on the network

asked 14 May '11, 16:12

Jignesh%20Furia's gravatar image

Jignesh Furia
1●1●1●1
accept rate: 0%

Yes you can, but it depends on the OS the user is on how to do it. Please enlighten us with the OS used :-)

(14 May '11, 16:17) SYN-bit ♦♦

Note that you'd also have to prevent users from installing Wireshark (or, in the case of Windows, WinPcap) themselves, or prevent them from running with sufficient privilege to capture packets. How you'd do that is also dependent on the OS the machine is running.

(17 May '11, 00:19) Guy Harris ♦♦

One Answer:

0

The easiest way would be to compile it without libpcap (or WinPcap if it's Windows).

[Update] Don't forget to drop by and Accept this answer if it answered your question.

answered 14 May '11, 18:37

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k●5●72
accept rate: 27%

edited 09 Mar '12, 07:02

Windows:
uninstall or just don't install WinPcap.
When you run the setup, you will get the question: Install WinPcap?
WinPcap is required to capture live network data.

(15 May '11, 02:10) joke