Download VisualEther
Free for Windows, macOS, and Linux. Turn Wireshark PCAP captures into readable sequence diagrams in minutes.
VisualEther Community Edition
Free for Windows, macOS, and Linux. The Community Edition runs whenever no license is installed — sequence diagrams are limited to 30 pages and 10 entities. Request a 45-day Professional trial to unlock session tracking, the MCP server for Claude Code, and unlimited output. See the release notes for what’s new in v9.1.4.
VisualEther runs in a terminal. It is a command-line tool — there is no application window to open. After installing, start a new terminal (one that was already open won’t see the updated PATH) and run visualether --version, then visualether new bgp for your first diagram. On Windows the installer also adds a VisualEther Terminal shortcut to your desktop and Start Menu, which opens a terminal ready to go.
Install with winget, the package manager built into Windows 10 and 11:
winget install EventHelix.VisualEtherUpgrade later with winget upgrade EventHelix.VisualEther. Or download the signed installer directly:
Windows 10 and later · x86_64. Requires Wireshark for the tshark dissector — version 4.6 or later recommended. The installer writes visualether.exe to C:\Program Files\EventHelix\VisualEther\, adds it to your PATH, and creates a VisualEther Start Menu folder.
Install from the EventHelix Homebrew tap:
brew install eventhelix/tap/visualetherUpgrade later with brew upgrade visualether. Or download the signed disk image directly:
Apple Silicon (arm64) only. Homebrew also installs Wireshark’s tshark automatically.
Ubuntu & Debian (apt)
Register the EventHelix repository once, then install:
curl -fsSL https://downloads.eventhelix.com/apt/eventhelix.gpg | sudo gpg --dearmor -o /usr/share/keyrings/eventhelix.gpg
echo "deb [signed-by=/usr/share/keyrings/eventhelix.gpg] https://downloads.eventhelix.com/apt stable main" | sudo tee /etc/apt/sources.list.d/eventhelix.list
sudo apt update && sudo apt install visualetherFedora (dnf)
Register the repository once, then install:
sudo curl -fsSL https://downloads.eventhelix.com/rpm/eventhelix.repo -o /etc/yum.repos.d/eventhelix.repo
sudo dnf install visualetherOr download a package directly:
Ubuntu 22.04+ / Debian 12+ / current Fedora · x86_64. The packages pull in Wireshark’s tshark automatically, and the repository stays registered so future upgrades go through apt / dnf normally. A distro’s stock Wireshark can lag well behind upstream (Ubuntu 24.04 ships 4.2.2); VisualEther works best with Wireshark 4.6 or later, since older builds silently miss the newest dissector fields. If tshark --version reports an older release, install a current build from wireshark.org or, on Ubuntu, the ppa:wireshark-dev/stable PPA.
Prerequisites
- A computer running Windows 10/11 (x86_64), macOS on Apple Silicon (arm64), or Linux — Ubuntu 22.04+, Debian 12+, or current Fedora (x86_64)
- Wireshark — 4.6 or later recommended. VisualEther reads captures through Wireshark's
tsharkdissector, and the newest protocol fields exist only in recent releases. An older build won't error out — it silently produces degraded or empty diagrams. Homebrew and the Linux packages pulltsharkin automatically; on Windows, install it yourself. - A terminal —
visualetheris a command-line tool that installs onto yourPATH. There is no application to launch: you type commands, and it writes diagrams. On Windows the installer adds a VisualEther Terminal shortcut to the desktop and Start Menu if you would rather click than type
Get started
- Confirm VisualEther is on your
PATH. Open a new terminal — one opened before installing won't see the updatedPATHyet — and run:
It prints the version and the active edition (Community until you add a trial key).visualether --version - Confirm Wireshark's
tsharkis on yourPATHand is 4.6 or newer:
Some Linux distros still ship 4.2 (e.g. Ubuntu 24.04 → 4.2.2). On an older build, the newest protocol fields are silently missing, so upgrade Wireshark — see the Linux note above.tshark --version - Follow the Getting Started walkthrough — from your first sequence diagram to AI-driven diagnosis and message-by-message annotation, all on the built-in BGP sample. It works on Community and unlocks fully on the trial, Professional, or Server.
Next step
Unlock the full workflow
The edition you just installed runs unlicensed as Community — capped at 30 pages and 10 entities. Add a free 45-day Professional trial key to the same executable to unlock session tracking, the MCP server for Claude Code, and unlimited output — the AI-driven analysis the whole workflow is built around.
Bundled fonts (optional)
VisualEther embeds the fonts it needs, so most users never download these. Grab an archive only for fully self-contained offline PDF rendering, or for CJK (Chinese, Japanese, Korean) glyph coverage. Choose .tar.gz on Linux / macOS or .zip on Windows.
All bundles are Noto fonts from Google, released under the SIL Open Font License 1.1. They are split into two archives by size:
- Latin + RTL (~1.9 MB) — Noto Sans (Latin: regular, bold, italic, bold-italic), Noto Sans Arabic (regular + bold), Noto Sans Hebrew (regular + bold), and Noto Sans Devanagari (regular + bold). Covers Western-European, right-to-left (Arabic, Hebrew), and Devanagari (Hindi, Marathi, …) text in your diagrams.
- CJK (~84 MB) — Noto Sans SC (Simplified Chinese), Noto Sans JP (Japanese), and Noto Sans CJK KR (Korean), plus bold CJK weights. Only needed when your captures carry Chinese, Japanese, or Korean text.
Verify a download against SHA256SUMS.txt — e.g. sha256sum -c SHA256SUMS.txt on Linux / macOS, or Get-FileHash on Windows.
Prefer to source the fonts yourself? These are the standard Google Noto families — get them from Google Fonts, the Noto project site, or your operating system's font packages (on Linux, fonts-noto and fonts-noto-cjk). Drop the .ttf / .otf files into VisualEther's fonts directory and they are picked up the same way.
Download archive
Older releases of VisualEther. Versions 7.2 and earlier are the legacy .NET edition for Windows; the cross-platform release above (9.x) supersedes them. Note that 9.x is a command-line tool driven from a terminal, not a windowed application — if you are coming from 7.x, start with the Getting Started walkthrough.