Wireshark 4.4.19 — the first minute without a single click
How we tested: a clean Debian 13 in a disposable container; source — package wireshark 4.4.19-0+deb13u1 from the Debian repository. Run as a regular user on a virtual screen, 60 seconds, nothing clicked. 18.10.2026. Every network request and every file written was recorded; the code was not decompiled. The container was deleted afterwards.
Program website: https://www.wireshark.org/
Package SHA-256: 9676f35f3eb79fdcdeae5023986f86df60bee0dd41662d9ba6ef5a64ce79cd4e
Summary
| What we checked | Result |
|---|---|
| Built-in telemetry, crash reporting, analytics, ad SDKs | Segment (usage statistics) |
| Network requests in the first minute | not a single network request |
| Known trackers among the servers | none |
| Files written in the first minute | 0 |
| The program ran the whole time | yes — process alive at the end |
What is built in
442 files (266 MB) were checked.
| SDK | Purpose | Found in |
|---|---|---|
| Segment | usage statistics | usr/lib/x86_64-linux-gnu/libwireshark.so.18 |
Addresses of known trackers in the program’s files — addresses in code, not requests:
| Tracker | Addresses | Mentions |
|---|---|---|
www.google.com | 7 | |
| OpenStreetMap | www.openstreetmap.org | 3 |
| unpkg | unpkg.com | 2 |
Where it connected
Not a single request: no DNS lookup, no connection.
What it wrote to disk
Nothing.
How to read this card
- This is the first minute after launch with no action at all: what the program does on its own. Normal use may involve more requests.
- A “built-in SDK” means the library’s code was found. It does not prove data transfer, and an address in the code is not a request.
- The review was made automatically using a single method. You can check any program yourself here.