How to Install Wireshark in Ubuntu
Installing Wireshark on Ubuntu is a straightforward process that empowers network administrators, students, and security enthusiasts to capture, analyze, and troubleshoot network traffic. This guide walks you through every step, from preparing your system to verifying the installation, ensuring you can start using Wireshark confidently.
Introduction
If you are looking for a reliable way to install wireshark in ubuntu, you have come to the right place. Whether you need to debug a slow application, investigate suspicious traffic, or simply learn how network protocols work, Wireshark provides the tools you need. Wireshark is the world’s most popular network protocol analyzer, offering a graphical interface as well as a powerful command‑line interface. The following sections cover the prerequisites, the installation steps, post‑install configuration, and a quick FAQ to address common questions.
Prerequisites
Before you begin the actual installation, make sure your Ubuntu system meets the following requirements:
- Supported Ubuntu Version – Wireshark works on Ubuntu 20.04 LTS, 22.04 LTS, and newer releases.
- Administrative Privileges – You will need
sudoaccess to install packages and modify system settings. - Internet Connection – The package manager will download the required binaries and libraries from Ubuntu’s repositories.
Note: While Wireshark can be compiled from source, the package manager method is recommended for most users because it handles dependencies automatically and keeps the software up‑to‑date.
Installing Wireshark via Apt
The easiest and most reliable way to install wireshark in ubuntu is by using the apt package manager. Follow these steps:
1. Update the Package Index
Open a terminal and run:
sudo apt update
This command refreshes the local package list, ensuring you install the latest version available in the repositories.
2. Install Required Dependencies
Wireshark depends on several libraries, such as libgtk-3-0, libpcap0.In practice, 8, and libssl1. 1 Most people skip this — try not to. Simple as that..
sudo apt install wireshark
During the installation, you will be prompted to choose a capture interface for the setuid binary. Select the default option (usually your primary network interface) unless you have a specific reason to change it.
3. Grant Capture Privileges
Wireshark needs permission to capture packets directly from the network interface. The package manager attempts to set the appropriate capabilities automatically, but you may need to verify and adjust them manually:
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap
If you encounter a warning about the binary not being set, run the command above to grant the required privileges. This step is crucial; without it, Wireshark will not be able to capture live traffic.
4. Verify the Installation
After the installation completes, launch Wireshark from the application menu or by typing:
wireshark
If the GUI opens without errors, the installation succeeded. You can also check the version:
wireshark -v
Configuring Permissions for Non‑Root Users
By default, only users in the wireshark group can capture packets. To add your user to this group:
sudo usermod -aG wireshark $USER
Log out and log back in (or reboot) for the group change to take effect. Once logged in, you should be able to start a capture without using sudo.
Understanding the Core Concepts
Before diving into advanced usage, it helps to understand a few key concepts:
- Promiscuous Mode – italic term indicating that the network card accepts all frames on the LAN, not just those addressed to it. Wireshark enables this mode automatically when starting a capture.
- Capture File (
.pcap) – The binary file format that stores raw packet data. You can open, save, and share these files with others. - Display Filter vs. Capture Filter – Display filters (e.g.,
http.request) are applied after capture to show specific packets, while capture filters (e.g.,tcp port 80) limit what gets recorded in the first place.
Post‑Installation Tips
1. Updating Wireshark
To keep Wireshark current, run:
sudo apt upgrade wireshark
If you need a newer version than the repository provides, consider adding the official Wireshark PPA:
sudo add-apt-repository ppa:wireshark-dev/ppa
sudo apt update
sudo apt install wireshark
2. Enabling Packet Capture Without Root
If you prefer not to modify file capabilities, you can start Wireshark with sudo:
sudo wireshark
Still, this is less secure, as it grants root privileges to the entire application. Adding your user to the wireshark group is the recommended approach.
3. Customizing the Interface
Wireshark’s preferences allow you to:
- Set the default capture interface.
- Adjust the amount of data displayed per packet.
- Choose color schemes for easier visual analysis.
Access these settings via Edit → Preferences (or Wireshark → Preferences on macOS/Linux) Worth knowing..
Common Issues and Solutions
| Issue | Likely Cause | Solution |
|---|---|---|
| “Permission denied” when starting a capture | Capture privileges not set correctly | Run sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap and re‑login |
| Wireshark crashes on launch | Missing GTK libraries | Ensure libgtk-3-0 is installed: sudo apt install libgtk-3-0 |
| No network interfaces listed | User not in wireshark group |
Add user: sudo usermod -aG wireshark $USER and log out/in |
FAQ
Q1: Can I install Wireshark on Ubuntu without a graphical desktop?
A: Yes. Use the wireshark-cli package (part of the main wireshark meta‑package) to capture packets headlessly. That said, the full GUI requires X11 or Wayland libraries.
Q2: Is Wireshark safe to use on a production server?
A: Capturing traffic on a live server can impact performance. Use a limited capture filter and keep the duration short. Always run Wireshark with the minimum required privileges Small thing, real impact..
Q3: How do I export captured data to a CSV file?
A: In the GUI, select File → Export Packet Dissections → As CSV. Choose the fields you need, and Wireshark will generate
