Getting Started with Wireshark Linux Network Troubleshooting

Published:2 March 2022 - 8 min. read

Nicholas Xuan Nguyen Image

Nicholas Xuan Nguyen

Read more tutorials by Nicholas Xuan Nguyen!

Suppose you’re a network admin and wish to capture packets on a network. In that case, you can either buy a fancy expensive hardware appliance or, better yet, use Wireshark Linux Network Protocol Analyzer.

Wireshark lets you capture packets and analyze them to your heart’s content. And in this tutorial, you’ll learn to install Wireshark on Linux while going through the basics of capturing packets and analyzing them.

Read on never to miss that critical network packet again!

Prerequisites

This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following.

  • A Linux machine – This tutorial uses Ubuntu 20.04 LTS, but any Linux distributions will work.

Installing Wireshark on Linux

By default, the Wireshark package comes with the base repositories of Ubuntu. But the version that comes with the repositories may be an older one, so you might want to install a more recent version.

You’ll first update your system, add the official Wireshark repository, and install the latest version of Wireshark using the APT package manager.

1. First, open a terminal window, and run the command below to update your package repositories. This command will check for updates and upgrade any outdated packages on your Ubuntu system.

sudo apt update && sudo apt upgrade -y
Updating Package Repositories
Updating Package Repositories

2. Next, run the apt install command below to install the required packages to add a new repository for Wireshark.

This command will install the following:

  • software-properties-common – Provides the apt_add_repository function to add a PPA (personal package archive) to install software from.
  • apt-transport-https – Provides the apt transport layer to HTTPS repositories needed for Wireshark and future added PPAs.

When a repository is set to HTTPS, the packages are downloaded using SSL encryption. This protocol prevents eavesdroppers from capturing packets on your network and snooping in.

sudo apt install software-properties-common apt-transport-https -y
Installing the Required Packages for Wireshark Repository
Installing the Required Packages for Wireshark Repository

3. Run the add-apt-repository command below to add the Wireshark development team’s PPA (personal package archive) (ppa:wireshark-dev/stable) to your Ubuntu system.

add-apt-repository is a tool that allows you to add PPAs without having to edit or create a file called sources.list manually. This tool comes in handy if you plan on installing additional repositories later.

sudo add-apt-repository ppa:wireshark-dev/stable

Press ENTER on your keyboard to add the new PPA, as shown below.

Adding the new Wireshark PPA
Adding the new Wireshark PPA

4. Now, run the ls command below to verify the sources.list file exists.

The sources.list file contains a list of all the PPAs your Ubuntu system can access, including the Wireshark PPA you just added.

ls /etc/apt/sources.list -l
Verifying the sources.list File Exists
Verifying the sources.list File Exists

5. Rerun the apt update command below to update your system and includes the new Wireshark PPA you just added.

sudo apt update -y

As shown below, you’ll see an extra line at the end of the output, which indicates that Wireshark repositories are on your system.

Updating your System to Add the Wireshark Repositories
Updating your System to Add the Wireshark Repositories

6. After updating your system, run the apt install command below to install the latest stable version of Wireshark on your machine.

sudo apt install wireshark -y

Select Yes and press ENTER on your keyboard to continue the installation when asked to allow non-superusers be able to capture packets, as shown below.

Wireshark captures data before it’s passed to the Linux kernel, where network privileges are defined. So, when running specific commands like sudo, superusers must authenticate themselves.

Allowing Non-Superusers to Capture Packets
Allowing Non-Superusers to Capture Packets

7. Finally, run the command below to check the Wireshark --version installed on your machine.

wireshark --version

As of this writing, the latest stable version of Wireshark is 3.4.8, as shown below, but yours may be different.

Checking Installed Wireshark Version
Checking Installed Wireshark Version

Since you’re new to Wireshark, run the wireshark –help command below to see the help manual for Wireshark.

wireshark --help
Checking the Wireshark Help Manual Page
Checking the Wireshark Help Manual Page

Capturing Packets using the Wireshark GUI

Now that you have Wireshark installed, you can begin capturing packets. And the good news is that Wireshark has a GUI, giving you the ability to capture and analyze packets with a few clicks. But you must first add your user to the wireshark group so you can capture packets.

1. Run the following usermod command on your system to add your username; in this case, it’s the non-root user ($(whoami)) to the wireshark group.

This command runs the whoami command with its output as an argument to the usermod command, so you can add users to groups without having to hard code group names.

sudo usermod -aG wireshark $(whoami)
Adding the non-root user to the wireshark Group
Adding the non-root user to the wireshark Group

2. Next, run the reboot command to restart your system for the changes to take effect. Once booted, log back in using the same user account you added to the wireshark group.

sudo reboot
Restarting the System
Restarting the System

3. Run the wireshark command below to open the Wireshark UI without any flags/options.

wireshark

When the Wireshark UI opens, you can safely ignore the nl80211 not found warning, as shown below, if the machine you’re using doesn’t have a wireless card. This warning is for troubleshooting wireless driver issues.

Opening the Wireshark UI from the Terminal
Opening the Wireshark UI from the Terminal

As shown below, you can also open the Wireshark UI from your applications finder on your Dock. Search for wireshark and launch Wireshark.

Opening up the Wireshark UI from Menu Bar
Opening up the Wireshark UI from Menu Bar

4. Click on the All interfaces show drop-down menu to choose which interfaces you want to capture packets from, as shown below. If your machine has a Wired card or a Bluetooth network adapter, you’ll see them listed too.

Select any network adapters and USB devices listed and click on the blue Wireshark icon at the toolbar to begin capturing packets. This demo uses the eth0 interface, the Ethernet card on the machine.

Selecting Network Interfaces where to Capture Packets
Selecting Network Interfaces where to Capture Packets

Although Wireshark lists out all the network interfaces on the system, not all of them may be active at the moment. For example, if you have a USB network adapter plugged into a laptop. The interface won’t be active unless you connect that USB device to a wireless access point at the time and broadcast packets over the air.

5. Run the basic ping command below to google.com on your terminal to test if your machine can reach the internet.

Depending on your machine’s configuration, your connection may or may not work. If you can reach google.com, your system can successfully reach the internet.

ping google.com

The Wireshark UI shows all of the packets your system sends and receives on the selected interface to the internet. And as you see below, Wireshark captured many packets from the selected interface.

Note that some machines won’t reach the internet due to firewall rules or other settings that are out of the scope of this article. You may have to set some IPTables or UF rules to allow packets to flow freely on your network or change settings during the receiving process.

Capturing Packets Using the Wireshark GUI Interface
Capturing Packets Using the Wireshark GUI Interface

6. Now, click on a packet in the packet list pane window and review more details about that packet. The tree view and byte view panes pop up automatically when you click on a packet, as shown below.

Viewing the tree view and byte view packet panel
Viewing the tree view and byte view packet panel

7. Click on the right-arrow button to expand any part of the tree to view more information about the selected packet. When you click on an item in the tree view pane, the byte view pane highlights how that value appears in bytes, as shown below.

Wireshark allows you to examine packets in great detail and find what’s causing your system not to reach the internet or other network issues.

Examining Selected Packets
Examining Selected Packets

Perhaps you prefer to view the packets in an independent window for clarity. If so, right-click on a packet and select Show Packet in New Window from the context menu, as shown below.

If you have many packets to view, switching between windows is much more efficient than examining them one at a time.

Viewing Packets in an Independent Window
Viewing Packets in an Independent Window

Filtering Packets with Filter String and Filter Expressions

Filtering out all other packets is preferable if you know exactly what you are looking for or want to view packets based on some condition (such as the destination IP address). For instance, your server might have hundreds or thousands of packets flying by quickly. Finding what you’re looking for in a sea of packets is almost impossible.

You can filter out all other packets by entering a filter string into the text box field at the top of the main Wireshark window. For example, you want to view only TCP packets to examine the headers of a TCP stream to find out why your machine cannot talk to the internet.

1. Enter tcp into the filter string field and hit ENTER, and you’ll only see packets that satisfy your filter string. Wireshark will ignore any other packet type and not be shown in the packet list pane below.

Listing TCP Packet Only
Listing TCP Packet Only

2. Next, click on Analyze —> Display Filter Expression. A new pane window pops up that allows you to do packet filtering in a more advanced way.

Accessing the Display Filter Expression Pane
Accessing the Display Filter Expression Pane

Below, you can see some filter expressions to find specific packets.

Viewing Comparisons Expressions
Viewing Comparisons Expressions

3. Finally, enter http in the search bar, click on http.bad_header_name —> is present —> OK to find illegal characters in the header name of the http request to your server from a client.

Finding illegal characters found in the header name of the http request
Finding illegal characters found in the header name of the http request

Saving Captured Packets to a File

If the problem you’re troubleshooting involves one or more packets, you can save those packets as they may come in handy for further analysis.

For example, you cannot solve a connectivity issue by watching packets live in Wireshark. But if you save those packets to a file, someone else (ISP or another networking professional) can view those packets and see what is happening on your network.

Click on the File menu —> Save As to choose the save location, and set a name for the file with a .pcap file extension (i.e., ata.pcap). Wireshark will save all packets captured in the session to the .pcap file. You can share this file with others to help troubleshoot your network problem.

Saving Captured Packets to a File
Saving Captured Packets to a File

Conclusion

In this article, you’ve learned how to install Wireshark on a Linux server for packet capture and analysis. You have also learned the basic Wireshark features of capture settings, different ways of filtering packets, and saving captured packets to a file.

With this newfound knowledge, you can now capture packets for troubleshooting your client-side DHCP issues or another network connectivity issue. At this point, you can already analyze packets for security purposes (checking encrypted traffic flows).

Hate ads? Want to support the writer? Get many of our tutorials packaged as an ATA Guidebook.

Explore ATA Guidebooks

Looks like you're offline!