--- title: "Getting Started with Wireshark Linux Network Troubleshooting" description: "Learn how to troubleshoot network issues by capturing packets using the Wireshark in Linux machines in this step-by-step tutorial!" canonical: "https://adamtheautomator.com/wireshark-linux/" --- # Getting Started with Wireshark Linux Network Troubleshooting > Learn how to troubleshoot network issues by capturing packets using the Wireshark in Linux machines in this step-by-step tutorial! Source: https://adamtheautomator.com/wireshark-linux/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Getting Started with Wireshark Linux Network Troubleshooting](https://adamtheautomator.com/wp-content/uploads/2022/03/Getting-Started-with-Wireshark-Linux-Network-Troubleshooting.jpg) # Getting Started with Wireshark Linux Network Troubleshooting [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)2 March 20227 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Logging](/tag/logging/)[Ubuntu Linux](/tag/ubuntu-linux/)[Wireshark](/tag/wireshark/) Table of Contents * [Prerequisites](#prerequisites) * [Installing Wireshark on Linux](#installing-wireshark-on-linux) * [Capturing Packets using the Wireshark GUI](#capturing-packets-using-the-wireshark-gui) * [Filtering Packets with Filter String and Filter Expressions](#filtering-packets-with-filter-string-and-filter-expressions) * [Saving Captured Packets to a File](#saving-captured-packets-to-a-file) * [Conclusion](#conclusion) Suppose you’re a network admin and wish to capture packets on a network. In that case, you can either buy a fancy expensive hardware appliance or, better yet, use [Wireshark](https://www.wireshark.org/) Linux Network Protocol Analyzer. Wireshark lets you capture packets and analyze them to your heart’s content. And in this tutorial, you’ll learn to install Wireshark on Linux while going through the basics of capturing packets and analyzing them. Read on never to miss that critical network packet again! ## Prerequisites This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following. * A Linux machine – This tutorial uses Ubuntu 20.04 LTS, but any Linux distributions will work. Related:[How to Install Ubuntu 20.04 LTS](https://adamtheautomator.com/install-ubuntu/) * A [non-root user with sudo privileges](https://www.liquidweb.com/kb/how-to-set-up-and-manage-sudo-permissions/). ## Installing Wireshark on Linux By default, the Wireshark package comes with the base repositories of Ubuntu. But the version that comes with the repositories may be an older one, so you might want to install a more recent version. You’ll first update your system, add the official Wireshark repository, and install the latest version of Wireshark using the APT package manager. Related:[Learning Ubuntu Apt Get Through Examples](https://adamtheautomator.com/ubuntu-apt-get/) 1\. First, open a terminal window, and run the command below to update your package repositories. This command will check for updates and upgrade any outdated packages on your Ubuntu system. ```bash sudo apt update && sudo apt upgrade -y ``` ![Updating Package Repositories](https://adamtheautomator.com/wp-content/uploads/2022/03/image.png) Updating Package Repositories 2\. Next, run the [`apt install`](https://linuxize.com/post/how-to-use-apt-command/#installing-packages-apt-install) command below to install the required packages to add a new repository for Wireshark. This command will install the following: * `software-properties-common` – Provides the [`apt_add_repository`](https://linuxize.com/post/how-to-add-apt-repository-in-ubuntu/) function to add a [PPA](https://itsfoss.com/ppa-guide/) (personal package archive) to install software from. * `apt-transport-https` – Provides the apt transport layer to HTTPS repositories needed for Wireshark and future added PPAs. When a repository is set to HTTPS, the packages are downloaded using SSL encryption. This protocol prevents eavesdroppers from capturing packets on your network and snooping in. ```bash sudo apt install software-properties-common apt-transport-https -y ``` ![Installing the Required Packages for Wireshark Repository](https://adamtheautomator.com/wp-content/uploads/2022/03/image-1.png) Installing the Required Packages for Wireshark Repository 3\. Run the [`add-apt-repository`](http://%3Chttps://manpages.ubuntu.com/manpages/trusty/man1/add-apt-repository.1.html) command below to add the [Wireshark development team’s PPA (personal package archive)](https://launchpad.net/~wireshark-dev/+archive/ubuntu/stable) (`ppa:wireshark-dev/stable`) to your Ubuntu system. add-apt-repository is a tool that allows you to add PPAs without having to edit or create a file called _sources.list manually_. This tool comes in handy if you plan on installing additional repositories later. ```bash sudo add-apt-repository ppa:wireshark-dev/stable ``` Press ENTER on your keyboard to add the new PPA, as shown below. ![Adding the new Wireshark PPA](https://adamtheautomator.com/wp-content/uploads/2022/03/image-2.png) Adding the new Wireshark PPA 4\. Now, run the `ls` command below to verify the `sources.list` file exists. The _sources.list_ file contains a list of all the PPAs your Ubuntu system can access, including the Wireshark PPA you just added. ```bash ls /etc/apt/sources.list -l ``` ![Verifying the sources.list File Exists](https://adamtheautomator.com/wp-content/uploads/2022/03/image-3.png) Verifying the _sources.list_ File Exists 5\. Rerun the `apt update` command below to update your system and includes the new Wireshark PPA you just added. ```bash sudo apt update -y ``` As shown below, you’ll see an extra line at the end of the output, which indicates that Wireshark repositories are on your system. ![Updating your System to Add the Wireshark Repositories](https://adamtheautomator.com/wp-content/uploads/2022/03/image-4.png) Updating your System to Add the Wireshark Repositories 6\. After updating your system, run the [`apt install`](https://linuxize.com/post/how-to-use-apt-command/#installing-packages-apt-install) command below to `install` the latest stable version of Wireshark on your machine. ```bash sudo apt install wireshark -y ``` Select Yes and press ENTER on your keyboard to continue the installation when asked to allow non-superusers be able to capture packets, as shown below. Wireshark captures data before it’s passed to the Linux kernel, where network privileges are defined. So, when running specific commands like sudo, superusers must authenticate themselves. ![Allowing Non-Superusers to Capture Packets](https://adamtheautomator.com/wp-content/uploads/2022/03/image-5.png) Allowing Non-Superusers to Capture Packets 7\. Finally, run the command below to check the Wireshark `--version` installed on your machine. ```bash wireshark --version ``` As of this writing, the latest stable version of Wireshark is 3.4.8, as shown below, but yours may be different. ![Checking Installed Wireshark Version](https://adamtheautomator.com/wp-content/uploads/2022/03/image-6.png) Checking Installed Wireshark Version Since you’re new to Wireshark, run the wireshark –help command below to see the help manual for Wireshark. ```bash wireshark --help ``` ![Checking the Wireshark Help Manual Page](https://adamtheautomator.com/wp-content/uploads/2022/03/image-7.png) Checking the Wireshark Help Manual Page ## Capturing Packets using the Wireshark GUI Now that you have Wireshark installed, you can begin capturing packets. And the good news is that Wireshark has a GUI, giving you the ability to capture and analyze packets with a few clicks. But you must first add your user to the _wireshark_ group so you can capture packets. 1\. Run the following [`usermod`](https://linuxize.com/post/usermod-command-in-linux/) command on your system to add your username; in this case, it’s the non-root user (`$(whoami)`) to the `wireshark` group. This command runs the [whoami](https://www.geeksforgeeks.org/whoami-command-linux-example/) command with its output as an argument to the usermod command, so you can add users to groups without having to hard code group names. ```bash sudo usermod -aG wireshark $(whoami) ``` ![Adding the non-root user to the wireshark Group](https://adamtheautomator.com/wp-content/uploads/2022/03/image-8.png) Adding the non-root user to the wireshark Group 2\. Next, run the `reboot` command to restart your system for the changes to take effect. Once booted, log back in using the same user account you added to the _wireshark_ group. ```bash sudo reboot ``` ![Restarting the System](https://adamtheautomator.com/wp-content/uploads/2022/03/image-9.png) Restarting the System 3\. Run the `wireshark` command below to open the Wireshark UI without any flags/options. ```bash wireshark ``` When the Wireshark UI opens, you can safely ignore the nl80211 not found warning, as shown below, if the machine you’re using doesn’t have a wireless card. This warning is for troubleshooting wireless driver issues. ![Opening the Wireshark UI from the Terminal](https://adamtheautomator.com/wp-content/uploads/2022/03/image.gif) Opening the Wireshark UI from the Terminal As shown below, you can also open the Wireshark UI from your applications finder on your Dock. Search for wireshark and launch Wireshark. ![Opening up the Wireshark UI from Menu Bar](https://adamtheautomator.com/wp-content/uploads/2022/03/image-1.gif) Opening up the Wireshark UI from Menu Bar 4\. Click on the **All interfaces show** drop-down menu to choose which interfaces you want to capture packets from, as shown below. If your machine has a **Wired** card or a **Bluetooth** network adapter, you’ll see them listed too. Select any network adapters and USB devices listed and click on the blue Wireshark icon at the toolbar to begin capturing packets. This demo uses the eth0 interface, the Ethernet card on the machine. ![Selecting Network Interfaces where to Capture Packets ](https://adamtheautomator.com/wp-content/uploads/2022/03/image-10.png) Selecting Network Interfaces where to Capture Packets > _Although Wireshark lists out all the network interfaces on the system, not all of them may be active at the moment. For example, if you have a USB network adapter plugged into a laptop. The interface won’t be active unless you connect that USB device to a wireless access point at the time and broadcast packets over the air._ 5\. Run the basic `ping` command below to [`google.com`](http://google.com/) on your terminal to test if your machine can reach the internet. Depending on your machine’s configuration, your connection may or may not work. If you can reach [google.com](http://google.com/), your system can successfully reach the internet. ```bash ping google.com ``` The Wireshark UI shows all of the packets your system sends and receives on the selected interface to the internet. And as you see below, Wireshark captured many packets from the selected interface. > _Note that some machines won’t reach the internet due to firewall rules or other settings that are out of the scope of this article. You may have to_ [set some IPTables](https://adamtheautomator.com/iptables-rules/) _or UF rules to allow packets to flow freely on your network or change settings during the receiving process._ Related:[How To Set Up the UFW Firewall on Linux](https://adamtheautomator.com/ufw-firewall/) ![Capturing Packets Using the Wireshark GUI Interface](https://adamtheautomator.com/wp-content/uploads/2022/03/image-2.gif) Capturing Packets Using the Wireshark GUI Interface 6\. Now, click on a packet in the packet list pane window and review more details about that packet. The tree view and byte view panes pop up automatically when you click on a packet, as shown below. ![Viewing the tree view and byte view packet panel](https://adamtheautomator.com/wp-content/uploads/2022/03/image-11.png) Viewing the tree view and byte view packet panel 7\. Click on the right-arrow button to expand any part of the tree to view more information about the selected packet. When you click on an item in the tree view pane, the byte view pane highlights how that value appears in bytes, as shown below. Wireshark allows you to examine packets in great detail and find what’s causing your system not to reach the internet or other network issues. ![Examining Selected Packets](https://adamtheautomator.com/wp-content/uploads/2022/03/image-3.gif) Examining Selected Packets Perhaps you prefer to view the packets in an independent window for clarity. If so, right-click on a packet and select Show Packet in New Window from the context menu, as shown below. If you have many packets to view, switching between windows is much more efficient than examining them one at a time. ![Viewing Packets in an Independent Window](https://adamtheautomator.com/wp-content/uploads/2022/03/image-12.png) Viewing Packets in an Independent Window ## Filtering Packets with Filter String and Filter Expressions Filtering out all other packets is preferable if you know exactly what you are looking for or want to view packets based on some condition (such as the destination IP address). For instance, your server might have hundreds or thousands of packets flying by quickly. Finding what you’re looking for in a sea of packets is almost impossible. You can filter out all other packets by entering a filter string into the text box field at the top of the main Wireshark window. For example, you want to view only TCP packets to examine the headers of a TCP stream to find out why your machine cannot talk to the internet. 1\. Enter **tcp** into the filter string field and hit ENTER, and you’ll only see packets that satisfy your filter string. Wireshark will ignore any other packet type and not be shown in the packet list pane below. ![Listing TCP Packet Only](https://adamtheautomator.com/wp-content/uploads/2022/03/image-13.png) Listing TCP Packet Only 2\. Next, click on **Analyze** —> **Display Filter Expression**. A new pane window pops up that allows you to do packet filtering in a more advanced way. ![Accessing the Display Filter Expression Pane](https://adamtheautomator.com/wp-content/uploads/2022/03/image-14.png) Accessing the Display Filter Expression Pane Below, you can see some [filter expressions](https://www.wireshark.org/docs/man-pages/wireshark-filter.html) to find specific packets. ![Viewing Comparisons Expressions](https://adamtheautomator.com/wp-content/uploads/2022/03/image-15.png) Viewing Comparisons Expressions 3\. Finally, enter **http** in the search bar, click on **http.bad\_header\_name** —> **is present** —> **OK** to find illegal characters in the header name of the http request to your server from a client. ![Finding illegal characters found in the header name of the http request](https://adamtheautomator.com/wp-content/uploads/2022/03/image-16.png) Finding illegal characters found in the header name of the http request ## Saving Captured Packets to a File If the problem you’re troubleshooting involves one or more packets, you can save those packets as they may come in handy for further analysis. For example, you cannot solve a connectivity issue by watching packets live in Wireshark. But if you save those packets to a file, someone else (ISP or another networking professional) can view those packets and see what is happening on your network. Click on the **File** menu —> **Save As** to choose the save location, and set a name for the file with a _[.pcap](https://en.wikipedia.org/wiki/Pcap)_ file extension (i.e., _ata.pcap_). Wireshark will save all packets captured in the session to the _.pcap_ file. You can share this file with others to help troubleshoot your network problem. ![Saving Captured Packets to a File](https://adamtheautomator.com/wp-content/uploads/2022/03/image-17.png) Saving Captured Packets to a File ## Conclusion In this article, you’ve learned how to install Wireshark on a Linux server for packet capture and analysis. You have also learned the basic Wireshark features of capture settings, different ways of filtering packets, and saving captured packets to a file. With this newfound knowledge, you can now capture packets for troubleshooting your [client-side DHCP](https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_Packet_Capture_to_Troubleshoot_Client-side_DHCP_Issues) issues or [another network connectivity](https://www.tecmint.com/wireshark-network-traffic-analyzer-for-linux/) issue. At this point, you can already analyze packets for security purposes (checking [encrypted](https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/) traffic flows). Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fwireshark-linux%2F&text=Getting%20Started%20with%20Wireshark%20Linux%20Network%20Troubleshooting)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fwireshark-linux%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fwireshark-linux%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/02/Network-Troubleshooting-from-the-Command-Line-with-TShark.jpg) ### [Network Troubleshooting from the Command-Line with TShark](/tshark/) Learn how to set up TShark on your machine to capture packets for effective network troubleshooting in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-To-Manage-Logfiles-with-Logrotate-in-Linux.jpg) ### [How to Configure Logrotate to Manage Logfiles (Step by Step)](/logrotate-linux/) Learn how to effectively manage, control, and tame logfiles with Logrotate in Linux with this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2024/03/openldap-4.jpg) ### [How to Install and Configure an OpenLDAP Ubuntu Server](/openldap/) Unlock the power of OpenLDAP on Ubuntu for centralized user authentication, seamless access control management, and enhanced directory services! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)