Wireshark: Analyze your network traffic

Wireshark is a tool that works as a network protocol analyzer, allowing to capture and analyze in real time, in an interactive way, the traffic that passes through a network. It is the most popular tool of this type. It runs on Windows, Mac, Linux and UNIX. Experts in fullfilment of security requirements, professionals in networks and educators use it regularly. It is free software, under the GNU GPL 2.

With this tool we will be able to analyze all the data packets that enter and leave any of our network interfaces (Ethernet or Wi-Fi cards). You can see this information in real time, and it can be filtered in real time as well. It is found in the repositories of the most popular books.

or by the terminal:

sudo apt-get install wireshark

It should be similar with the package handlers of the other distributions.

Since the default users do not have permission to handle the network interfaces directly, and to avoid using Wireshark as root, this "fix" must be done so that a regular Ubuntu user can use the tool without problems. These commands must first be run in a terminal

sudo addgroup –quiet –system wireshark sudo chown root: wireshark / usr / bin / dumpcap sudo setcap cap_net_raw, cap_net_admin = eip / usr / bin / dumpcap

What this does is create a new group and allow the use of dumpcap (the program that uses Wireshar by default for the capture) then we add our user to the new group

sudo usermod -a -G wireshark youruser

(remember that you must change your username to your username)

And reconfigure Wireshark so that non-administrators can capture packets:

sudo dpkg-reconfigure wireshark-common

Select "Yes", it should work without problems.

Source: vlara