How to Install and Use Wireshark on Ubuntu Linux?

Wireshark is an open-source network protocol analyzer that helps us to see what is happening inside a network when we try to communicate with other networks. Currently, Wireshark is the most famous application to analyze networks. As the most popular network analyzer tool, Wireshark provides an in-depth view of your network traffic, making it an essential tool for anyone working with networks.

Steps to Install  Wireshark on Ubuntu Linux

To install the latest version of Wireshark on Ubuntu we have to follow certain steps:

Step 1: Open the Terminal

Go to the terminal by simply pressing 'Ctrl + Alt + T' or 'right-click + Open in Terminal'.

Step 2: Add the Wireshark Repository

Add a repository by running this command,

sudo add-apt-repository ppa:wireshark-dev/stable

Step 3: Update the Repository List

After adding the repository, update your system's package list to include the latest packages:

sudo apt update

Step 4: Install Wireshark

With the repository updated, install Wireshark using the following command:

sudo apt install wireshark

Step 5: Launch Wireshark

Wireshark is installed, you can run in the terminal to do so run this command

sudo wireshark

or just simply go to show applications and run Wireshark.

You can check the version of your installed Wireshark by running the following command

apt show wireshark

If you face any error during installation or running Wireshark like Wireshark xdg_runtime_dir not set then open the terminal and run this command and click YES to the message box

sudo dpkg-reconfigure wireshark-common

After opening Wireshark if you can see wavy lines beside enp0s3 then congratulations, you are all set and good to go. 

Troubleshooting Installation Errors

If you encounter any errors during installation, such as the common 'Wireshark xdg_runtime_dir not set' error, run the following command:

sudo dpkg-reconfigure wireshark-common

How to Use Wireshark for Network Packet Analysis

To capture the networking packages using Wireshark follow these steps:

Step 1: Start Capturing Packets

Go to Wireshark and double click on the first option 'enp0s3' to start capturing

Step 2: Monitor Captured Data

You can see a window with various source and destination IP addresses, protocols, lengths, etc. This is where you are capturing the protocols. The Protocol is showing currently which network protocol is running on your system and their source and destination IP addresses. You can also apply filters by protocol names to see only the packets you want to see. 

Step 3: Stop and Restart Capture

After capturing all the required packets that you want, you can stop by simply clicking the red square button at the top-left. To start capturing again just click the blue button beside the red stop button. 

To know more about the usage of Wireshark, you can refer to the article – Packet Capturing and Analyzing.

Conclusion

Wireshark is a critical tool for network monitoring, troubleshooting, and analysis. With its powerful features and user-friendly interface, Wireshark empowers you to identify and resolve network issues, enhance security, and optimize performance. By following the steps above, you can quickly set up Wireshark and begin monitoring your network's traffic with ease.