more explicit wireshark search for windows