Wireshark logs the network traffic of the interfaces of the system on which it is installed.

A counter-test of who owns such an IP address may then put you on the trail of an attack. You can also statistically evaluate the collected data traffic, for example by searching for particularly large packets or picking out addresses that are frequently accessed. Wireshark, for example, can be used to expose notoriously programs using networks to perform some unusual tasks. The IP address of the target system is always logged. IT can record the traffic, where you can look at the contents of a data packet. This open-source application is very useful for network administrators.

Apart from it, the executable can be downloaded for Windows and Mac OS. The Sniffer Wireshark is available in all Linux distributions to easily install. Sudo rm -rf /etc/apt//wireshark-dev-ubuntu-stable-focal.Use the default system repository to install Wireshark of Ubuntu 22.04 LTS Jammy Jellyfish or 20.04 focal fossa Linux distros. Remove GPG key and repository: sudo rm -rf /etc/apt//wireshark-dev_ubuntu_stable.gpg If you wish to completely remove TShark and all related dependencies, execute the following command: sudo apt purge -autoremove -y tshark The -i option allows to capture packets on specific network interface. We can find network interfaces which are available to the TShark with command: tshark -D After reconnection, you can check TShark version: tshark -versionĮxecute tshark command without any arguments to start capturing packets on default network interface: tshark In order to make changes to take effect, logout and login to your machine. Run the following command to add current user to a wireshark group: sudo usermod -a -G wireshark $USER It will add wireshark group and anyone who is a member of this group will be able to capture packets without being root user. Install TShark: sudo apt install -y tsharkĭuring installation you will be asked if you want to allow non-root users to able to capture packets. Install TSharkĪdd the Wireshark and TShark repository: sudo add-apt-repository -y ppa:wireshark-dev/stable This tutorial demonstrates how to install TShark on Ubuntu 20.04. TShark is a command line version of Wireshark that can be used when graphical user interface isn't available. This tool enables to capture packets from a network and print them to the standard output. TShark is a command line tool for analyzing network traffic.

Install wireshark linux command line