This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

Is there any way to disable the capturimg feature on wire shark so that user can read only prevoiusly captured files but can not capture the packets on the network

asked 14 May '11, 16:12

Jignesh%20Furia's gravatar image

Jignesh Furia
1111
accept rate: 0%

Yes you can, but it depends on the OS the user is on how to do it. Please enlighten us with the OS used :-)

(14 May '11, 16:17) SYN-bit ♦♦

Note that you'd also have to prevent users from installing Wireshark (or, in the case of Windows, WinPcap) themselves, or prevent them from running with sufficient privilege to capture packets. How you'd do that is also dependent on the OS the machine is running.

(17 May '11, 00:19) Guy Harris ♦♦

The easiest way would be to compile it without libpcap (or WinPcap if it's Windows).

[Update] Don't forget to drop by and Accept this answer if it answered your question.

permanent link

answered 14 May '11, 18:37

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

edited 09 Mar '12, 07:02

Windows:
uninstall or just don't install WinPcap.
When you run the setup, you will get the question: Install WinPcap?
WinPcap is required to capture live network data.

(15 May '11, 02:10) joke
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×6
×5

question asked: 14 May '11, 16:12

question was seen: 4,068 times

last updated: 09 Mar '12, 07:02

p​o​w​e​r​e​d by O​S​Q​A