How to install and use Wireshark in Ubuntu 22.04

Wireshark is a free and open source, cross-platform, GUI-based network packet analyzer available for Linux, Windows, MacOS, Solaris, and more. It captures network packets in real-time and presents them in human-readable format. It enables us to monitor network packets at a microscopic level. It also has a command line program called tshark which performs the same functions as Wireshark, but through the terminal rather than through the GUI.

Wireshark can be used for network troubleshooting, analysis, software and communications protocol development, and for educational purposes. Wireshark uses a library called pcap to capture network packets.

Features of Wireshark

• Supports inspection of hundreds of protocols
• Ability to capture packets in real time and save them for later offline analysis
• Some Filters for analyzing data
• Captured data can be compressed and decompressed dynamically
• Supports multiple data analysis file formats, and output can also be saved in XML, CSV, plain text format
• Can capture data from multiple interfaces such as Ethernet, WiFi, Bluetooth, USB, Frame Relay, Token Ring, etc.

Prerequisites

• Pre-installed Ubuntu 22.04
• Local user with sudo privileges
• Internet connection

Wireshark installation steps

Install from Ubuntu repository

Wireshark The package is available in the default Ubuntu repository and can be simply installed using the following command. But you may not be able to get the latest version of wireshark.

$ sudo apt update$ sudo apt install wireshark

Apt-Command-Install-Wireshark-Ubuntu

Select "Yes" to allow non-superusers to use Wireshark to capture packets:

Allow-Non-SuperUsers-To-Capture-Packets-Wireshark-Ubuntu

After successful installation, access the Wireshare UI. Search for "Wireshark" in "Activities" and click on its icon.

Wireshark-UI-Ubuntu-Linux-Desktop

The above confirms that your Wireshark installation has been completed successfully.

Install the latest version

If you want to install the latest version of Wireshark, we must enable the official Wireshark repository using the following apt command:

$ sudo add-apt-repository ppa:wireshark-dev/stable$ sudo apt update

Now, To install the latest version of Wireshark, run:

$ sudo apt install wireshark -y

After installing Wireshark, verify its version:

$ wireshark --version

Wireshark-Version-Check-Ubuntu-Linux

To allow normal users to use Wireshark to consume and capture packets, run the following command:

$ sudo dpkg-reconfigure wireshark-common

Select "Yes" and press Enter.

Allow-Regular-User-Use-Wireshark-Ubuntu

Use the usermod command to add local users to wireshark Group:

$ sudo usermod -aG wireshark $USER$ newgrp wireshark

For the above changes to take effect, please restart the system.

$ sudo reboot

Use Wireshark to capture packets

Start Wireshark and search for "wireshark" from "Activities"->.

Access-Wireshark-Ubuntu-Desktop

Access-Wireshark-Ubuntu-Desktop

Click the Wireshark icon,

Choose-Interface-Wireshark-UI-Ubuntu

All these are the interfaces through which we can capture network packets. Depending on the interface on your system, this page may look different.

We choose "enp0s3" to capture the network traffic of this interface. After selecting the interface, we can start populating network packets for all the devices on our network (see screenshot below)

Capturing-Packets-WireShark-UI-Ubuntu

The first time we see this page, we may be overwhelmed by the data displayed in this screen and may think of how to organize this data, but don’t worry, one of the best features of Wireshark is its filter.

We can sort/filter data based on IP address, port number, we can also use source and destination filters, packet size, etc. We can also combine 2 or more filters together to create More comprehensive search. We can write a filter in the "Apply a Display Filter" tab or select one of the already created rules. If you want to select a pre-built filter, click the "Flag" icon and select the "Apply Display Filter" tab.

IP-Based-Filtering-WireShark-UI-Ubuntu

We can also filter data based on color code, by default, light purple is TCP Traffic, light blue is UDP traffic, and black identifies packets with errors. To see the meaning of these codes, click "View" -> "Coloring Rules", we can also change these codes.

Coloring-Rules-WireShark-Ubuntu

Once we get the desired results, we can click on any captured packet to get information about that packet for more details, which will display all the data about that network packet.

To stop capturing packets, click the red stop button and save the captured packets to a file.

Save-Captured-Packets-Wireshark-Ubuntu

Summary

Wireshark is a very powerful tool that takes some time to Get used to it and master it, this article will help you get started.

The above is the detailed content of How to install and use Wireshark in Ubuntu 22.04. For more information, please follow other related articles on the PHP Chinese website!