How To Check If Wireshark Is Installed On Linux

Wireshark is a network bundle analyzer. It captures every packet getting in or out of a network interface and shows them in a nicely formatted text. It is used past Network Engineers all over the world.

Wireshark is cross platform and information technology is available for Linux, Windows and Mac OS. You get the same user experience in any operating system you utilize.

To learn more about Wireshark, visit the official website of Wireshark at https://www.wireshark.org

In this article, I will evidence you how to install Wireshark on Ubuntu and how to use it. I am using Ubuntu eighteen.04 LTS for the demonstration. But it should work on any LTS version of Ubuntu still supported at the time of this writing. Permit's get started.

Installing Wireshark:

Wireshark is available in the official packet repository of Ubuntu 14.04 LTS and later. So it is really easy to install.

Start update the APT packet repository cache with the post-obit control:

The APT package repository enshroud should be updated.

Now, Run the following command to install Wireshark on your Ubuntu automobile:

$ sudo apt install wireshark

At present printing y and so press <Enter>.

By default, Wireshark must be started as root (can too exist washed with sudo) privileges in gild to work. If you want to run Wireshark without root privileges or without sudo, and then select <Yes> and printing <Enter>.

Wireshark should exist installed.

Now if you lot selected <Yes> in the earlier section to run Wireshark without root access, and so run the following command to add your user to the wireshark grouping:

$ sudo usermod -aG wireshark $( whoami )

Finally, reboot your computer with the following control:

Starting Wireshark:

At present that Wireshark is installed, you can start Wireshark from the Awarding Card of Ubuntu.

You can also run the following command to showtime Wireshark from the Terminal:

If you lot did not enable Wireshark to run without root privileges or sudo, and then the command should exist:

Wireshark should kickoff.

Capturing Packets Using Wireshark:

When y'all start Wireshark, you will see a list of interfaces that you can capture packets to and from.

There are many types of interfaces yous tin can monitor using Wireshark, for example, Wired, Wireless, USB and many external devices. You lot can choose to evidence specific types of interfaces in the welcome screen from the marked section of the screenshot beneath.

Here, I listed only the Wired network interfaces.

Now to kickoff capturing packets, just select the interface (in my case interface ens33) and click on the Kickoff capturing packets icon as marked in the screenshot below. You can also double click on the interface that y'all desire to capture packets to and from to start capturing packets on that particular interface.

You can also capture packets to and from multiple interfaces at the aforementioned fourth dimension. Only press and concur <Ctrl> and click on the interfaces that y'all want to capture packets to and from and so click on the Start capturing packets icon every bit marked in the screenshot below.

Using Wireshark on Ubuntu:

I am capturing packets on the ens33 wired network interface as you can see in the screenshot below. Correct now, I accept no captured packets.

I pinged google.com from the concluding and equally you can see, many packets were captured.

At present you can click on a packet to select it. Selecting a package would testify many information about that parcel. Every bit you lot tin see, information about different layers of TCP/IP Protocol is listed.

You tin also see the RAW information of that particular packet.

You lot tin can also click on the arrows to expand packet data for a particular TCP/IP Protocol Layer.

Filtering Packets Using Wireshark:

On a busy network thousands or millions of packets will be captured each 2d. And then the list will be so long that information technology will be near impossible to gyre through the list and search for certain blazon of packet.

The good thing is, in Wireshark, you can filter the packets and see only the packets that you need.

To filter packets, you tin directly type in the filter expression in the textbox equally marked in the screenshot beneath.

Yous tin can likewise filter packets captured by Wireshark graphically. To exercise that, click on the Expression… push every bit marked in the screenshot below.

A new window should open up every bit shown in the screenshot below. From here y'all can create filter expression to search packets very specifically.

In the Field Proper noun department virtually all the networking protocols are listed. The list is huge. Yous can type in what protocol you're looking for in the Search textbox and the Field Name section would bear witness the ones that matched.

In this article, I am going to filter out all the DNS packets. So I selected DNS Domain Proper name Arrangement from the Field Name list. You can also click on the arrow on any protocol

And make your selection more specific.

You lot can also apply relational operators to test whether some field is equal to, non equal to, great than or less than some value. I searched for all the DNS IPv4 address which is equal to 192.168.ii.1 as you tin can come across in the screenshot below.

The filter expression is besides shown in the marked section of the screenshot beneath. This is a great style to learn how to write filter expression in Wireshark.

In one case you're washed, just click on OK.

At present click on the marked icon to Apply the filter.

As you can encounter, merely the DNS protocol packets are shown.

Stopping Package Capture in Wireshark:

Y'all tin can click on the scarlet icon as marked in the screenshot below to end capturing Wireshark packets.

Saving Captured Packets to a File:

Yous can click on the marked icon to save captured packets to a file for future apply.

At present select a destination folder, type in the file name and click on Save.

The file should exist saved.

Now y'all can open and analyze the saved packets anytime. To open the file, get to File > Open from Wireshark or press <Ctrl> + o

Then select the file and click on Open up.

The captured packets should exist loaded from the file.

And so that'south how you install and use Wireshark on Ubuntu. Thank you for reading this article.

Virtually the author

Freelancer & Linux System Administrator. Also loves Web API evolution with Node.js and JavaScript. I was born in Bangladesh. I am currently studying Electronics and Advice Engineering at Khulna Academy of Engineering science & Technology (KUET), i of the demanding public technology universities of Bangladesh.

Source: https://linuxhint.com/install_wireshark_ubuntu/

Posted by: youngweneary.blogspot.com

Share this post