3.4. Obtaining The Wireshark Sources

There are two primary ways to obtain Wireshark’s source code: Git and compressed .tar archives. Each is described in more detail below. We recommend using Git for day to day development, particularly if you wish to contribute changes back to the project. The age mentioned in the following sections indicates the age of the most recent change in that set of the sources.

3.4.1. Git Over SSH Or HTTPS

This method is strongly recommended for day to day development.

You can use a Git client to download the source code from Wireshark’s code review system. Anyone can clone from the anonymous HTTP git URL:


If you have a GitLab account you can also clone using SSH:

[email protected]:wireshark/wireshark.git

If wish to make changes to Wireshark you must create a GitLab account, create a fork of the official Wireshark repository, update your fork, and create a merge request. See Section 3.10, “Contribute Your Changes” for details.

The following example shows how to get up and running on the command line. See Section 4.11, “Git client” for information on installing and configuring graphical Git clients.

  1. Now on to the command line. First, make sure git works:

    $ git --version
  2. If this is your first time using Git, make sure your username and email address are configured. This is particularly important if you plan on uploading changes:

    $ git config --global user.name "Henry Perry"
    $ git config --global user.email [email protected]
  3. Next, clone the Wireshark repository:

    # If you have a GitLab account, you can use the SSH URL:
    $ git clone -o upstream [email protected]:wireshark/wireshark.git
    # If you don't you can use the HTTPS URL:
    $ git clone -o upstream https://gitlab.com/wireshark/wireshark.git
    # You can speed up cloning in either case by adding --shallow-since=1year or --depth=5000.

    The clone only has to be done once. This will copy all the sources (including directories) from the server to your machine and check out the latest version.

    The -o upstream flag uses the origin name “upstream” for the repository instead of the default “origin” as described in the GitLab documentation.

    Cloning may take some time depending on the speed of your internet connection.

    The --shallow-since=1year option limits cloned commits to the last 1 year.

    The --depth=5000 option limits cloned commits to the last 5000.

3.4.2. Development Snapshots

This method is useful for one-off builds or if Git is inaccessible (e.g. because of a restrictive firewall).

Our GitLab CI configuration automatically generates development packages, including source packages. They can be found at https://www.wireshark.org/download/automated/src/. Packages are available for recent commits in the master branch and each release branch.

3.4.3. Official Source Releases

This method is recommended for building downstream release packages.

The official source releases can be found at https://www.wireshark.org/download.html. You should use these sources if you want to build Wireshark on your platform based on an official release with minimal or no changes, such as Linux distribution packages.