How To Install Wireshark On Linux : Wireshark Network Packet Capture

by

Network administrators rely on Wireshark to capture and analyze traffic, and installing it on Linux takes just a few commands. This guide will show you exactly how to install Wireshark on Linux using different methods. Whether you use Ubuntu, Debian, Fedora, or Arch, you will find clear steps here.

Wireshark is a powerful tool for network troubleshooting and analysis. It lets you see what is happening on your network at a microscopic level. Many Linux distributions include it in their official repositories, making installation simple.

Before you start, ensure your system is updated. Open a terminal and run the update command for your distribution. This prevents package conflicts during installation.

Prerequisites For Installing Wireshark

You need a working Linux system with internet access. Most installations require sudo privileges. Check if you have sudo access by running sudo -v in the terminal.

Your system should have at least 500 MB of free disk space. Wireshark itself is small, but captured packet files can grow large. Also, ensure you have a network interface to capture traffic from.

  • A Linux distribution (Ubuntu, Debian, Fedora, CentOS, Arch, etc.)
  • Internet connection for downloading packages
  • Sudo or root access
  • At least 500 MB free disk space
  • A network interface (wired or wireless)

How To Install Wireshark On Linux

This section covers the main methods for installing Wireshark. The exact steps vary slightly depending on your distribution. We will cover the most common ones.

Method 1: Install Wireshark On Ubuntu And Debian

Ubuntu and Debian use the APT package manager. Open a terminal and update your package list first.

  1. Run sudo apt update to refresh the repository cache.
  2. Run sudo apt install wireshark -y to install Wireshark and its dependencies.
  3. During installation, you will be asked if non-superusers should be able to capture packets. Select “Yes” if you want regular users to capture traffic.
  4. After installation, add your user to the wireshark group: sudo usermod -aG wireshark $USER
  5. Log out and log back in for the group changes to take effect.

If you chose “No” during installation, you can change it later with sudo dpkg-reconfigure wireshark-common. This reopens the configuration dialog.

Method 2: Install Wireshark On Fedora And RHEL

Fedora and Red Hat Enterprise Linux use DNF. The process is straightforward.

  1. Update your system: sudo dnf update
  2. Install Wireshark: sudo dnf install wireshark -y
  3. Add your user to the wireshark group: sudo usermod -aG wireshark $USER
  4. Log out and log back in.

On older RHEL versions, you may need to enable the EPEL repository first. Run sudo dnf install epel-release before installing Wireshark.

Method 3: Install Wireshark On Arch Linux

Arch Linux users can install Wireshark from the official repositories using Pacman.

  1. Update your system: sudo pacman -Syu
  2. Install Wireshark: sudo pacman -S wireshark-qt
  3. Add your user to the wireshark group: sudo usermod -aG wireshark $USER
  4. Log out and log back in.

The wireshark-qt package includes the graphical interface. If you only need the command-line tool, install wireshark-cli instead.

Method 4: Install Wireshark Using Snap

Snap packages work across many distributions. This method is useful if you want the latest version.

  1. Ensure Snap is installed: sudo snap install core
  2. Install Wireshark: sudo snap install wireshark
  3. Grant permissions: sudo snap connect wireshark:network-control
  4. Launch Wireshark from the application menu or terminal.

Snap versions run in a sandbox. They may have limited access to some network interfaces. If you encounter issues, try the repository method instead.

Method 5: Install Wireshark From Source

Compiling from source gives you full control. This is for advanced users who need custom features.

  1. Install build dependencies: sudo apt build-dep wireshark (Ubuntu/Debian) or equivalent.
  2. Download the source code from the Wireshark website.
  3. Extract the archive: tar xvf wireshark-*.tar.xz
  4. Navigate to the directory: cd wireshark-*
  5. Configure the build: mkdir build && cd build && cmake ..
  6. Compile: make -j$(nproc)
  7. Install: sudo make install
  8. Add your user to the wireshark group and log out.

This method takes longer but gives you the latest features. It also allows you to enable or disable specific components.

Post-Installation Configuration

After installing Wireshark, you need to configure it properly. This ensures you can capture packets without running as root.

Setting Up User Permissions

Wireshark uses the wireshark group to grant capture privileges. Adding your user to this group is essential.

  • Run sudo usermod -aG wireshark $USER
  • Log out completely and log back in.
  • Verify with groups command. You should see wireshark listed.

If you skip this step, Wireshark will prompt you for root password each time. This is not recommended for security reasons.

Configuring Capture Interfaces

Wireshark needs to detect your network interfaces. Sometimes it may not show them immediately.

  1. Open Wireshark from the application menu.
  2. Click on “Capture” in the menu bar.
  3. Select “Options” to see available interfaces.
  4. If no interfaces appear, run sudo wireshark once to initialize them.

You can also check interfaces with ip link show or ifconfig. Ensure your interface is up before capturing.

Running Wireshark Without Root

To run Wireshark as a normal user, you must have the correct permissions. The wireshark group handles this.

  • After adding your user to the group, log out and back in.
  • Launch Wireshark from the application menu.
  • You should see all interfaces without entering a password.

If you still get permission errors, check the group membership with id. Also, ensure the dumpcap binary has the correct setuid permissions: sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap.

Common Installation Issues And Fixes

Sometimes installation does not go smoothly. Here are common problems and their solutions.

Issue: Package Not Found

If your package manager says “package not found,” update your repositories first. Run sudo apt update or sudo dnf update.

On older distributions, enable additional repositories. For Ubuntu, ensure universe repository is enabled: sudo add-apt-repository universe.

Issue: Permission Denied When Capturing

This usually means you are not in the wireshark group. Recheck your group membership.

  • Run groups to see your groups.
  • If wireshark is missing, add yourself again: sudo usermod -aG wireshark $USER
  • Log out completely and log back in.

If the issue persists, check the dumpcap permissions: ls -l /usr/bin/dumpcap. It should have setuid bit set.

Issue: Wireshark GUI Not Launching

If the graphical interface does not start, try launching from terminal: wireshark. Look for error messages.

  • Missing Qt libraries: Install qt5-default or qt5-qtbase.
  • Display issues: Ensure your display manager is running.
  • Try tshark (command-line version) to verify installation.

Issue: Snap Version Cannot Capture

Snap packages have restricted access. Connect the network-control interface: sudo snap connect wireshark:network-control.

If still not working, install the repository version instead. Snap is convenient but may have limitations.

Verifying Your Wireshark Installation

After installation, verify that everything works correctly. Open Wireshark and start a test capture.

  1. Launch Wireshark from the application menu.
  2. Select a network interface (e.g., eth0 or wlan0).
  3. Click the blue shark fin icon to start capture.
  4. Generate some traffic by visiting a website.
  5. Stop the capture and check if packets appear.

You can also use the command-line tool tshark. Run tshark -i eth0 -c 10 to capture 10 packets. If you see output, installation is successful.

Uninstalling Wireshark

If you need to remove Wireshark, use your package manager. This removes the software but may leave configuration files.

  • Ubuntu/Debian: sudo apt remove wireshark
  • Fedora/RHEL: sudo dnf remove wireshark
  • Arch: sudo pacman -R wireshark-qt
  • Snap: sudo snap remove wireshark

To remove configuration files as well, use sudo apt purge wireshark on Debian-based systems. This cleans up group settings and user data.

Frequently Asked Questions

Here are common questions about installing Wireshark on Linux. These cover variations of the main keyword.

Can I Install Wireshark On Linux Without Sudo?

No, you need sudo or root access to install packages. However, after installation, you can run Wireshark as a normal user if you are in the wireshark group.

What Is The Difference Between Wireshark And Tshark?

Wireshark is the graphical interface. Tshark is the command-line version. Both are installed together in most packages. Tshark is useful for scripting and remote capture.

How Do I Install Wireshark On Linux Mint?

Linux Mint is based on Ubuntu. Use the same APT commands: sudo apt update && sudo apt install wireshark. The steps are identical.

Does Wireshark Work On All Linux Distributions?

Yes, Wireshark is available for most distributions. The installation method varies, but the software works the same. Check your distribution’s repository for the package.

Why Do I Get “Couldn’t Run /Usr/bin/dumpcap” Error?

This error means the dumpcap binary lacks proper permissions. Run sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap to fix it. Also, ensure you are in the wireshark group.

Final Thoughts On Installing Wireshark

Installing Wireshark on Linux is a simple process. The repository method works for most users. Snap is a good alternative if you want the latest version.

Remember to add your user to the wireshark group after installation. This avoids permission issues later. Test your installation with a quick capture to ensure everything works.

Wireshark is an essential tool for network analysis. With it installed, you can diagnose network problems, analyze protocols, and learn how data flows across your network. The command-line tool tshark is also useful for automated tasks.

If you encounter any issues, check the official Wireshark documentation or your distribution’s forums. The community is active and helpful. Now you are ready to start capturing and analyzing network traffic on your Linux system.