If everything is working properly, the window starts to be filled with a table refreshing constantly:Įach line is a packet detected by Wireshark.You can also double-click on the interface name, use the “Capture” menu, or just press CTRL+E. Click on the first icon in the top bar.In general, it will be “eth0” if your computer is plugged via Ethernet, or “wlan0” if you are using a Wi-Fi connection. Select the interface you want to capture in the list.

This will be pretty useful for the analysis part I’ll introduce later (and it’s also used by hackers and pen-testers).Īnyway, here is how to start a capture with Wireshark: If your computer is just one element of your network, it will mostly be your own network usage, and a few talks between your device and the other ones.īut when your computer or server is an important node of this network (DNS server, gateway, etc.), it will record almost anything happening on the network. Basically, the idea is to listen to what’s happening on one of your network interfaces. The main feature that you’ll use frequently with Wireshark is the capture. So, if you want to allow the current user to use Wireshark captures, type the following command: The allowed users have to be added in the wireshark group. If you need to be able to capture packets with normal users, there is another extra step to allow each user individually.

That’s the thing missing with Ubuntu software, so please answer “Yes” if you need it.īy default, only superusers can capture packets with Wireshark.Īfter that, the packages will be installed on your system, just wait a few minutes. During the installation, you will be asked if you want to allow normal users to run a capture:.It will install all the dependencies at the same time. You can then install the wireshark package with:.Wireshark is available in the Ubuntu software (the “app store”), but it comes with a few issues related to the permissions for normal users, so I recommend using APT in a command line to install it. Grab your free PDF file with all the commands you need to know on Linux!

Wireshark command line only http