In the example above, I am connected via the interface ' enp5s0'. If you are using a wired connection, then you should select that interface. If you are using a 'wireless' adaptor, then select that interface. To start the capture process you first need to select an interface. The following screenshots have been taken from wireshark version running on a Linux Mint installation. Wireshark uses a simple filter to remove unwanted data from its captures. A command line version of Wireshark known as 'Tshark' is also available for download. Wireshark can read data from 'Ethernet', '802.11', 'PPP' and 'loopback' networks. (pcap - packet capture implemented in the libpcap library under Linux). Wireshark uses ' pcap' to capture packets. This enables Wireshark to easily display the structures of packets along with descriptions. Wireshark is a specialized tool that understands many network protocols and their structures. SLES/openSUSE distributions can install Wireshark by issuing the following command from a terminal: zypper install wiresharkĪlternatively, you can download the packages and source code for wireshark from their main website: Red Hat Based distributions (CentOS/Rocky Linux/Fedora) can install Wireshark by issuing the following command from a terminal: dnf install wireshark

Wireshark is available for most distributions of Linux and can be installed from most repositories.ĭebian Based systems (Ubuntu/Mint) can install Wireshark by issuing the following command from a terminal: sudo apt update & apt install wireshark Wireshark, formerly knowns as 'Etherreal' was renamed to 'Wireshark' in the year 2006. Wireshark is generally used by administrators for analyzing traffic on a network, troubleshooting network issues. Wireshark is a free Open Source Packet Analyser. Wireshark Packet Capture What is Wireshark?

Wireshark capture packets from site