Wireshark is a free and open-source packet analyzer that allows users to capture and analyze network traffic in real-time. It was originally known as Ethereal and was developed by Gerald Combs in 1998. Wireshark is available for multiple platforms, including Windows, macOS, and Linux.
The tool is used by network administrators and security professionals to troubleshoot network issues, detect and prevent network attacks, and analyze network performance. It can capture and display a wide range of protocols, including TCP, UDP, HTTP, DNS, and many more. This makes it an indispensable tool for any organization that relies on networks to carry out its operations.
One of the key features of Wireshark is its ability to capture packets in real-time. This allows users to see network traffic as it is happening and quickly identify any anomalies or suspicious activity. Wireshark can also save captured packets to a file for later analysis, which can be useful for forensics and incident response.
Another important feature of Wireshark is its powerful filtering capabilities. Users can apply filters to capture only the packets they are interested in, making it easier to analyze large network traces. Wireshark supports a wide range of filter expressions, including protocol types, IP addresses, and port numbers.
In addition to packet capturing and analysis, Wireshark also includes tools for generating traffic and sending packets. This can be useful for testing network configurations and verifying the behavior of network devices.
Wireshark is a very flexible tool that can be customized to suit the needs of individual users. It supports a range of plugins and extensions, which can add new functionality to the tool. It also has a rich ecosystem of third-party tools and scripts that can be used to extend its capabilities even further.
One of the challenges of using Wireshark is that it can generate large amounts of data. Capturing and analyzing packets can quickly consume a lot of disk space and processing power. Users need to be aware of these limitations and use the tool judiciously to avoid overwhelming their systems.
Despite these challenges, Wireshark is an essential tool for anyone who works with networks. Its ability to capture, analyze, and filter network traffic makes it an invaluable resource for troubleshooting, security, and performance tuning. With its rich set of features and flexibility, Wireshark is a must-have tool for any network professional.
Screenshots
wireshark
tshark Usage Example
:~# tshark -f "tcp port 80" -i eth0
Packages and Binaries:
libwireshark-data
The libwireshark library provides the network packet dissection services developed by the Wireshark project.
This package contains the platform independent files.
Installed size:7.25 MBHow to install:sudo apt install libwireshark-data
libwireshark-dev
The “libwireshark” library provides the network packet dissection services developed by the Wireshark project.
This package contains the static library and the C header files that are needed for applications to use libwireshark services.
Installed size:4.44 MBHow to install:sudo apt install libwireshark-dev
Dependencies:
libwireshark16
libwiretap-dev
libwsutil-dev
libwireshark16
The libwireshark library provides the network packet dissection services developed by the Wireshark project.
Installed size:107.87 MBHow to install:sudo apt install libwireshark16
Dependencies:
libbcg729-0
libbrotli1
libc-ares2
libc6
libgcrypt20
libglib2.0-0
libgnutls30
libgpg-error0
libk5crypto3
libkrb5-3
liblua5.2-0
liblz4-1
libnghttp2-14
libpcre2-8-0
libsbc1
libsmi2ldbl
libsnappy1v5
libspandsp2
libwireshark-data
libwiretap13
libwsutil14
libxml2
libzstd1
zlib1g
libwiretap-dev
Wiretap, part of the Wireshark project, is a library that allows one to read and write several packet capture file formats.
Supported formats are:
Libpcap
Sniffer
LANalyzer
Network Monitor
“snoop”
“iptrace”
Sniffer Basic (NetXRay)/Windows Sniffer Pro
RADCOM WAN/LAN Analyzers
Lucent/Ascend access products
HP-UX nettl
Toshiba ISDN Router
ISDN4BSD “i4btrace” utility
Cisco Secure Intrusion Detection System iplogging facility
pppd logs (pppdump-format files)
VMS TCPTRACE
DBS Etherwatch (text format)
Catapult DCT2000 (.out files)
Wiretap’s shortcomings are: no filter capability and no support for packet capture.
This package contains the static library and the C header files.
Installed size:195 KBHow to install:sudo apt install libwiretap-dev
Dependencies:
libwiretap13
libwiretap13
Wiretap, part of the Wireshark project, is a library that allows one to read and write several packet capture file formats.
Supported formats are:
Libpcap
Sniffer
LANalyzer
Network Monitor
“snoop”
“iptrace”
Sniffer Basic (NetXRay)/Windows Sniffer Pro
RADCOM WAN/LAN Analyzers
Lucent/Ascend access products
HP-UX nettl
Toshiba ISDN Router
ISDN4BSD “i4btrace” utility
Cisco Secure Intrusion Detection System iplogging facility
pppd logs (pppdump-format files)
VMS TCPTRACE
DBS Etherwatch (text format)
Catapult DCT2000 (.out files)
Wiretap’s shortcomings are: no filter capability and no support for packet capture.
Installed size:694 KBHow to install:sudo apt install libwiretap13
Dependencies:
libc6
libglib2.0-0
liblz4-1
libwsutil14
libzstd1
zlib1g
libwsutil-dev
The libwsutil library provides utility functions for libwireshark6.
This package contains the static library and the C header files that are needed for applications to use the libwsutil library.
Installed size:366 KBHow to install:sudo apt install libwsutil-dev
Dependencies:
libwsutil14
libwsutil14
The libwsutil library provides utility functions for libwireshark15.
Installed size:269 KBHow to install:sudo apt install libwsutil14
Dependencies:
libc6
libgcrypt20
libglib2.0-0
libgnutls30
libpcre2-8-0
tshark
Wireshark is a network “sniffer” - a tool that captures and analyzes packets off the wire. Wireshark can decode too many protocols to list here.
This package provides the console version of wireshark, named “tshark”.
Installed size:403 KBHow to install:sudo apt install tshark
Dependencies:
libc6
libglib2.0-0
libpcap0.8
libpcre2-8-0
libwireshark16
libwiretap13
libwsutil14
wireshark-common
zlib1g
tshark
Dump and analyze network traffic
:~# tshark -h
TShark (Wireshark) 4.0.3 (Git v4.0.3 packaged as 4.0.3-1)
Dump and analyze network traffic.
See https://www.wireshark.org for more information.
Usage: tshark [options] ...
Capture interface:
-i <interface>, --interface <interface>
name or idx of interface (def: first non-loopback)
-f <capture filter> packet filter in libpcap filter syntax
-s <snaplen>, --snapshot-length <snaplen>
packet snapshot length (def: appropriate maximum)
-p, --no-promiscuous-mode
don't capture in promiscuous mode
-I, --monitor-mode capture in monitor mode, if available
-B <buffer size>, --buffer-size <buffer size>
size of kernel buffer (def: 2MB)
-y <link type>, --linktype <link type>
link layer type (def: first appropriate)
--time-stamp-type <type> timestamp method for interface
-D, --list-interfaces print list of interfaces and exit
-L, --list-data-link-types
print list of link-layer types of iface and exit
--list-time-stamp-types print list of timestamp types for iface and exit
Capture stop conditions:
-c <packet count> stop after n packets (def: infinite)
-a <autostop cond.> ..., --autostop <autostop cond.> ...
duration:NUM - stop after NUM seconds
filesize:NUM - stop this file after NUM KB
files:NUM - stop after NUM files
packets:NUM - stop after NUM packets
Capture output:
-b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
duration:NUM - switch to next file after NUM secs
filesize:NUM - switch to next file after NUM KB
files:NUM - ringbuffer: replace after NUM files
packets:NUM - switch to next file after NUM packets
interval:NUM - switch to next file when the time is
an exact multiple of NUM secs
Input file:
-r <infile>, --read-file <infile>
set the filename to read from (or '-' for stdin)
Processing:
-2 perform a two-pass analysis
-M <packet count> perform session auto reset
-R <read filter>, --read-filter <read filter>
packet Read filter in Wireshark display filter syntax
(requires -2)
-Y <display filter>, --display-filter <display filter>
packet displaY filter in Wireshark display filter
syntax
-n disable all name resolutions (def: "mNd" enabled, or
as set in preferences)
-N <name resolve flags> enable specific name resolution(s): "mnNtdv"
-d <layer_type>==<selector>,<decode_as_protocol> ...
"Decode As", see the man page for details
Example: tcp.port==8888,http
-H <hosts file> read a list of entries from a hosts file, which will
then be written to a capture file. (Implies -W n)
--enable-protocol <proto_name>
enable dissection of proto_name
--disable-protocol <proto_name>
disable dissection of proto_name
--enable-heuristic <short_name>
enable dissection of heuristic protocol
--disable-heuristic <short_name>
disable dissection of heuristic protocol
Output:
-w <outfile|-> write packets to a pcapng-format file named "outfile"
(or '-' for stdout)
--capture-comment <comment>
add a capture file comment, if supported
-C <config profile> start with specified configuration profile
-F <output file type> set the output file type, default is pcapng
an empty "-F" option will list the file types
-V add output of packet tree (Packet Details)
-O <protocols> Only show packet details of these protocols, comma
separated
-P, --print print packet summary even when writing to a file
-S <separator> the line separator to print between packets
-x add output of hex and ASCII dump (Packet Bytes)
--hexdump <hexoption> add hexdump, set options for data source and ASCII dump
all dump all data sources (-x default)
frames dump only frame data source
ascii include ASCII dump text (-x default)
delimit delimit ASCII dump text with '|' characters
noascii exclude ASCII dump text
help display help for --hexdump and exit
-T pdml|ps|psml|json|jsonraw|ek|tabs|text|fields|?
format of text output (def: text)
-j <protocolfilter> protocols layers filter if -T ek|pdml|json selected
(e.g. "ip ip.flags text", filter does not expand child
nodes, unless child is specified also in the filter)
-J <protocolfilter> top level protocol filter if -T ek|pdml|json selected
(e.g. "http tcp", filter which expands all child nodes)
-e <field> field to print if -Tfields selected (e.g. tcp.port,
_ws.col.Info)
this option can be repeated to print multiple fields
-E<fieldsoption>=<value> set options for output when -Tfields selected:
bom=y|n print a UTF-8 BOM
header=y|n switch headers on and off
separator=/t|/s|<char> select tab, space, printable character as separator
occurrence=f|l|a print first, last or all occurrences of each field
aggregator=,|/s|<char> select comma, space, printable character as
aggregator
quote=d|s|n select double, single, no quotes for values
-t a|ad|adoy|d|dd|e|r|u|ud|udoy
output format of time stamps (def: r: rel. to first)
-u s|hms output format of seconds (def: s: seconds)
-l flush standard output after each packet
-q be more quiet on stdout (e.g. when using statistics)
-Q only log true errors to stderr (quieter than -q)
-g enable group read access on the output file(s)
-W n Save extra information in the file, if supported.
n = write network address resolution information
-X <key>:<value> eXtension options, see the man page for details
-U tap_name PDUs export mode, see the man page for details
-z <statistics> various statistics, see the man page for details
--export-objects <protocol>,<destdir>
save exported objects for a protocol to a directory
named "destdir"
--export-tls-session-keys <keyfile>
export TLS Session Keys to a file named "keyfile"
--color color output text similarly to the Wireshark GUI,
requires a terminal with 24-bit color support
Also supplies color attributes to pdml and psml formats
(Note that attributes are nonstandard)
--no-duplicate-keys If -T json is specified, merge duplicate keys in an object
into a single key with as value a json array containing all
values
--elastic-mapping-filter <protocols> If -G elastic-mapping is specified, put only the
specified protocols within the mapping file
--temp-dir <directory> write temporary files to this directory
(default: /tmp)
Diagnostic output:
--log-level <level> sets the active log level ("critical", "warning", etc.)
--log-fatal <level> sets level to abort the program ("critical" or "warning")
--log-domains <[!]list> comma separated list of the active log domains
--log-debug <[!]list> comma separated list of domains with "debug" level
--log-noisy <[!]list> comma separated list of domains with "noisy" level
--log-file <path> file to output messages to (in addition to stderr)
Miscellaneous:
-h, --help display this help and exit
-v, --version display version info and exit
-o <name>:<value> ... override preference setting
-K <keytab> keytab file to use for kerberos decryption
-G [report] dump one of several available reports and exit
default report="fields"
use "-G help" for more help
Dumpcap can benefit from an enabled BPF JIT compiler if available.
You might want to enable it by executing:
"echo 1 > /proc/sys/net/core/bpf_jit_enable"
Note that this can make your system less secure!
wireshark
Wireshark is a network “sniffer” - a tool that captures and analyzes packets off the wire. Wireshark can decode too many protocols to list here.
This is a meta-package for Wireshark.
Installed size:37 KBHow to install:sudo apt install wireshark
Dependencies:
wireshark-qt
wireshark-common
Wireshark is a network “sniffer” - a tool that captures and analyzes packets off the wire. Wireshark can decode too many protocols to list here.
This package provides files common to both wireshark and tshark (the console version).
Installed size:1.34 MBHow to install:sudo apt install wireshark-common
Dependencies:
debconf
debconf | debconf-2.0
libc6
libcap2
libcap2-bin
libgcrypt20
libglib2.0-0
libmaxminddb0
libnl-3-200
libnl-genl-3-200
libpcap0.8
libpcre2-8-0
libspeexdsp1
libssh-gcrypt-4
libsystemd0
libwireshark16
libwiretap13
libwsutil14
zlib1g
capinfos
Prints information about capture files
:~# capinfos -h
Capinfos (Wireshark) 4.0.3 (Git v4.0.3 packaged as 4.0.3-1)
Print various information (infos) about capture files.
See https://www.wireshark.org for more information.
Usage: capinfos [options] <infile> ...
General infos:
-t display the capture file type
-E display the capture file encapsulation
-I display the capture file interface information
-F display additional capture file information
-H display the SHA256, RIPEMD160, and SHA1 hashes of the file
-k display the capture comment
Size infos:
-c display the number of packets
-s display the size of the file (in bytes)
-d display the total length of all packets (in bytes)
-l display the packet size limit (snapshot length)
Time infos:
-u display the capture duration (in seconds)
-a display the capture start time
-e display the capture end time
-o display the capture file chronological status (True/False)
-S display start and end times as seconds
Statistic infos:
-y display average data rate (in bytes/sec)
-i display average data rate (in bits/sec)
-z display average packet size (in bytes)
-x display average packet rate (in packets/sec)
Metadata infos:
-n display number of resolved IPv4 and IPv6 addresses
-D display number of decryption secrets
Output format:
-L generate long report (default)
-T generate table report
-M display machine-readable values in long reports
Table report options:
-R generate header record (default)
-r do not generate header record
-B separate infos with TAB character (default)
-m separate infos with comma (,) character
-b separate infos with SPACE character
-N do not quote infos (default)
-q quote infos with single quotes (')
-Q quote infos with double quotes (")
Miscellaneous:
-h, --help display this help and exit
-v, --version display version info and exit
-C cancel processing if file open fails (default is to continue)
-A generate all infos (default)
-K disable displaying the capture comment
Options are processed from left to right order with later options superseding
or adding to earlier options.
If no options are given the default is to display all infos in long report
output format.
captype
Prints the types of capture files
:~# captype -h
Captype (Wireshark) 4.0.3 (Git v4.0.3 packaged as 4.0.3-1)
Print the file types of capture files.
See https://www.wireshark.org for more information.
Usage: captype [options] <infile> ...
Miscellaneous:
-h, --help display this help and exit
-v, --version display version info and exit
dumpcap
Dump network traffic
:~# dumpcap -h
Dumpcap (Wireshark) 4.0.3 (Git v4.0.3 packaged as 4.0.3-1)
Capture network packets and dump them into a pcapng or pcap file.
See https://www.wireshark.org for more information.
Usage: dumpcap [options] ...
Capture interface:
-i <interface>, --interface <interface>
name or idx of interface (def: first non-loopback),
or for remote capturing, use one of these formats:
rpcap://<host>/<interface>
<host>:<port>
--ifname <name> name to use in the capture file for a pipe from which
we're capturing
--ifdescr <description>
description to use in the capture file for a pipe
from which we're capturing
-f <capture filter> packet filter in libpcap filter syntax
-s <snaplen>, --snapshot-length <snaplen>
packet snapshot length (def: appropriate maximum)
-p, --no-promiscuous-mode
don't capture in promiscuous mode
-I, --monitor-mode capture in monitor mode, if available
-B <buffer size>, --buffer-size <buffer size>
size of kernel buffer in MiB (def: 2MiB)
-y <link type>, --linktype <link type>
link layer type (def: first appropriate)
--time-stamp-type <type> timestamp method for interface
-D, --list-interfaces print list of interfaces and exit
-L, --list-data-link-types
print list of link-layer types of iface and exit
--list-time-stamp-types print list of timestamp types for iface and exit
-d print generated BPF code for capture filter
-k <freq>,[<type>],[<center_freq1>],[<center_freq2>]
set channel on wifi interface
-S print statistics for each interface once per second
-M for -D, -L, and -S, produce machine-readable output
Stop conditions:
-c <packet count> stop after n packets (def: infinite)
-a <autostop cond.> ..., --autostop <autostop cond.> ...
duration:NUM - stop after NUM seconds
filesize:NUM - stop this file after NUM kB
files:NUM - stop after NUM files
packets:NUM - stop after NUM packets
Output (files):
-w <filename> name of file to save (def: tempfile)
-g enable group read access on the output file(s)
-b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
duration:NUM - switch to next file after NUM secs
filesize:NUM - switch to next file after NUM kB
files:NUM - ringbuffer: replace after NUM files
packets:NUM - ringbuffer: replace after NUM packets
interval:NUM - switch to next file when the time is
an exact multiple of NUM secs
printname:FILE - print filename to FILE when written
(can use 'stdout' or 'stderr')
-n use pcapng format instead of pcap (default)
-P use libpcap format instead of pcapng
--capture-comment <comment>
add a capture comment to the output file
(only for pcapng)
--temp-dir <directory> write temporary files to this directory
(default: /tmp)
Diagnostic output:
--log-level <level> sets the active log level ("critical", "warning", etc.)
--log-fatal <level> sets level to abort the program ("critical" or "warning")
--log-domains <[!]list> comma separated list of the active log domains
--log-debug <[!]list> comma separated list of domains with "debug" level
--log-noisy <[!]list> comma separated list of domains with "noisy" level
--log-file <path> file to output messages to (in addition to stderr)
Miscellaneous:
-N <packet_limit> maximum number of packets buffered within dumpcap
-C <byte_limit> maximum number of bytes used for buffering packets
within dumpcap
-t use a separate thread per interface
-q don't report packet capture counts
-v, --version print version information and exit
-h, --help display this help and exit
Dumpcap can benefit from an enabled BPF JIT compiler if available.
You might want to enable it by executing:
"echo 1 > /proc/sys/net/core/bpf_jit_enable"
Note that this can make your system less secure!
Example: dumpcap -i eth0 -a duration:60 -w output.pcapng
"Capture packets from interface eth0 until 60s passed into output.pcapng"
Use Ctrl-C to stop capturing at any time.
editcap
Edit and/or translate the format of capture files
:~# editcap -h
Editcap (Wireshark) 4.0.3 (Git v4.0.3 packaged as 4.0.3-1)
Edit and/or translate the format of capture files.
See https://www.wireshark.org for more information.
Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]
<infile> and <outfile> must both be present; use '-' for stdin or stdout.
A single packet or a range of packets can be selected.
Packet selection:
-r keep the selected packets; default is to delete them.
-A <start time> only read packets whose timestamp is after (or equal
to) the given time.
-B <stop time> only read packets whose timestamp is before the
given time.
Time format for -A/-B options is
YYYY-MM-DDThh:mm:ss[.nnnnnnnnn][Z|+-hh:mm]
Unix epoch timestamps are also supported.
Duplicate packet removal:
--novlan remove vlan info from packets before checking for duplicates.
-d remove packet if duplicate (window == 5).
-D <dup window> remove packet if duplicate; configurable <dup window>.
Valid <dup window> values are 0 to 1000000.
NOTE: A <dup window> of 0 with -V (verbose option) is
useful to print MD5 hashes.
-w <dup time window> remove packet if duplicate packet is found EQUAL TO OR
LESS THAN <dup time window> prior to current packet.
A <dup time window> is specified in relative seconds
(e.g. 0.000001).
NOTE: The use of the 'Duplicate packet removal' options with
other editcap options except -V may not always work as expected.
Specifically the -r, -t or -S options will very likely NOT have the
desired effect if combined with the -d, -D or -w.
