Ubuntu 上 Wireshark 的安装与使用
嗅探 Wireshark

> 
> 在本教程中，你将学习如何在 Ubuntu 和其它基于 Ubuntu 的发行版上安装最新的 Wireshark。同时你也将学习如何在没有 sudo 的情况下来运行 Wireshark，以及如何设置它来进行数据包嗅探。
> 
> 
> 


[Wireshark](https://www.wireshark.org/) 是一款自由开源的网络协议分析器，它在全球被广泛使用。


通过使用 Wireshark，你可以实时捕获网络的传入和传出数据包，并将其用于网络故障排除、数据包分析、软件和通信协议开发等。


它适用于所有主流的桌面操作系统，如 Windows、Linux、macOS、BSD 等。


在本教程中，我将指导你在 Ubuntu 和其他基于 Ubuntu 的发行版上安装 Wireshark 。我还将介绍如何设置和配置 Wireshark 来捕获数据包。


### 在基于 Ubuntu 的 Linux 发行版上安装 Wireshark


![](/data/attachment/album/202003/12/115531iuuw57udntwcdv2w.png)


Wireshark 适用于所有主流 Linux 发行版。你应该查看[官方安装说明](https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallUnixInstallBins.html)。因为在本教程中，我将着重在仅基于 Ubuntu 的发行版上安装最新版本的 Wireshark 。


Wireshark 可以在 Ubuntu 的 Universe 存储库中找到。你可以[启用 universe 存储库](https://itsfoss.com/ubuntu-repositories/)，然后按如下方式安装：



```
sudo add-apt-repository universe
sudo apt install wireshark
```

这种方法的一个小问题是，你可能并不总是得到最新版本的 Wireshark 。


例如，在 Ubuntu 18.04 中，如果你使用 [apt](https://itsfoss.com/apt-command-guide/) 命令检查 Wireshark 的可用版本，可用版本会显示是 2.6 。



```
abhishek@nuc:~$ apt show wireshark
Package: wireshark
Version: 2.6.10-1~ubuntu18.04.0
Priority: optional
Section: universe/net
Origin: Ubuntu
Maintainer: Balint Reczey <rbalint@ubuntu.com>
```

然而， [Wireshark 3.2 稳定版](https://www.wireshark.org/news/20191218.html)已经在几个月前发布了。当然，新版本拥有新的特性。


那么在这种情况下，你应该怎么办呢？谢天谢地， Wireshark 开发者提供了一种官方 PPA 方式，你可以使用它在 Ubuntu 和其它基于 Ubuntu 的发行版上安装最新稳定版本的 Wireshark.


我希望你熟悉 PPA。如果没有，请[阅读我们关于 PPA 的优秀指南，以便完全理解它](https://itsfoss.com/ppa-guide/)。


打开终端并逐个使用以下命令：



```
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt update
sudo apt install wireshark
```

即使安装了旧版本的 Wireshark ，它也将更新为新版本。


安装时，系统将询问你是否允许非超级用户捕获数据包。选择“Yes”允许，选择“No”限制非超级用户捕获数据包，最后完成安装。


### 不使用 sudo 运行 Wireshark


如果在上一次安装中选择了“No”，则以 root 用户身份运行以下命令：



```
sudo dpkg-reconfigure wireshark-common
```

然后按 `tab` 键并使用回车键选择“No”：


![](/data/attachment/album/202003/12/115535e0v0wqnn5x50w62r.png)


由于你允许非超级用户捕获数据包，因此你必须将该用户添加到 `wireshark` 组。使用 [usermod](https://linuxhandbook.com/usermod-command/) 命令将自己添加到 `wireshark` 组。



```
sudo usermod -aG wireshark $(whoami)
```

最后，[重启你的 Ubuntu 系统](https://itsfoss.com/schedule-shutdown-ubuntu/)对你的系统进行必要的修改。



> 
> 冷知识
> 
> 
> Wireshark 于 1998 年首次发布，最初被称为 Ethereal 。2006 年，由于商标问题，开发商不得不将其名称改为 Wireshark 。
> 
> 
> 


### 启动 Wireshark


你可以从应用程序启动器或者命令行启动 Wireshark 应用。


如果从命令行启动，只需要在你的控制台中输入 `wireshark`：



```
wireshark
```

要是从**图形化界面**启动，需要在搜索栏搜索 Wireshark 应用，并按回车键。


![](/data/attachment/album/202003/12/115537zetu5e1t5iwp85dd.png)


现在，让我们来玩玩 Wireshark 吧。


### 使用 Wireshark 捕获数据包


当你启动 Wireshark 的时候，你会看到一个接口列表，你可以使用它来捕获这个接口接收和发送的数据包。


你可以使用 Wireshark 监视许多类型的接口，例如，有线、外部设备等。根据你的偏好，你可以从下图中的标记区域选择在欢迎屏幕中显示特定类型的接口。


![Select interface](/data/attachment/album/202003/12/115540wprooaftzo8l39nz.jpg)


例如，我只列出了**有线**网络接口。


![](/data/attachment/album/202003/12/115542aiddliilletd3izx.jpg)


接下来，要开始捕获数据包，你必须选择接口（在我的示例中是 `ens33` ），然后单击“Start capturing packets”图标，如下图所示。


![Start capturing packets with Wireshark](/data/attachment/album/202003/12/115544uxcek5e5knxekeun.jpg)


你还可以同时从多个接口捕获数据包。只需按住 `CTRL` 按钮，同时单击要捕获的接口，然后点击“Start capturing packets”图标，如下图所示。


![](/data/attachment/album/202003/12/115545zs8pqaup3t9rro8r.jpg)


接下来，我尝试在终端中使用 `ping google.com` 命令，如你所见，捕获了许多数据包。


![Captured packets](/data/attachment/album/202003/12/115548eiyixoj8emk8glhm.jpg)


现在你可以选择任何数据包来检查该特定数据包。在点击一个特定的包之后，你可以看到与它相关的 TCP/IP 协议的不同层的信息。


![Packet info](/data/attachment/album/202003/12/115550arsmqmwp2rxvw26u.png)


你还可以在底部看到该特定数据包的原始数据，如下图所示。


![Check RAW data in the captured packets](/data/attachment/album/202003/12/115554n5704o7qqa071smm.png)



> 
> 这就是为什么端到端加密很重要。
> 
> 
> 假设你正在登录一个不使用 HTTPS 的网站。与你在同一网络上的任何人都可以嗅探数据包，并在原始数据中看到用户名和密码。
> 
> 
> 这就是为什么现在大多数聊天应用程序使用端到端加密，而大多数网站使用 https （而不是 http）。
> 
> 
> 


#### 在 Wireshark 中停止数据包捕获


你可以点击如图所示的红色图标停止捕获数据包。


![Stop packet capture in Wireshark](/data/attachment/album/202003/12/115559yo00jd5dflrvafw5.png)


#### 将捕获的数据包保存成文件


你可以单击下图中标记的图标，将捕获的数据包保存到文件中以备将来使用。


![Save captured packets by Wireshark](/data/attachment/album/202003/12/115602hk5na15uykknbwek.jpg)


**注意**：输出可以导出为 XML、PostScript、CSV 或纯文本。


接下来，选择一个目标文件夹，键入文件名并单击“Save”。


然后选择文件并单击“Open”。


![](/data/attachment/album/202003/12/115605w6nimr6r0xa0sb7a.jpg)


现在你可以随时打开和分析保存的数据包。要打开文件，请按 `\+o`，或从 Wireshark 转到 “File > Open”。


捕获的数据包将从文件中加载。


![](/data/attachment/album/202003/12/115607eccpcpcc0wwzk0bu.png)


### 结语


Wireshark 支持许多不同的通信协议。有许多选项和功能，使你能够以独特的方式捕获和分析网络数据包。你可以从 Wireshark 的[官方文档](https://www.wireshark.org/docs/https://www.wireshark.org/docs/)了解更多关于 Wireshark 的信息。


我希望这个教程能帮助你在 Ubuntu 上安装 Wireshark 。请让我知道你的问题和建议。




---


via: <https://itsfoss.com/install-wireshark-ubuntu/>


作者：[Community](https://itsfoss.com/author/itsfoss/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[qianmigntian](https://github.com/qianmigntian) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
![Warp Terminal](/assets/images/warp-terminal.webp)


![Warp Terminal](/assets/images/warp-terminal.webp)

[Wireshark](https://www.wireshark.org/?ref=itsfoss.com) is a free and open-source network protocol analyzer widely used around the globe.

With Wireshark, you can capture incoming and outgoing packets of a network in real time and use it for network troubleshooting, packet analysis, software and communication protocol development, and many more.

It is available on all major desktop operating systems like Windows, Linux, macOS, BSD and more.

In this tutorial, I will guide you to install Wireshark on Ubuntu and other Ubuntu-based distributions. I’ll also show a little about setting up and configuring Wireshark to capture packets.

# Installing Wireshark on Ubuntu based Linux distributions

Wireshark is available on all major Linux distributions. You should check out the [official installation instructions](https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallUnixInstallBins.html?ref=itsfoss.com). In this tutorial, I’ll focus on installing the latest Wireshark version on Ubuntu-based distributions only.

Wireshark is available in the Universe repository of Ubuntu, which is usually enabled by default. If not, you can [enable universe repository](https://itsfoss.com/ubuntu-repositories/) and then install it by running:

`sudo apt install wireshark`


One slight problem with this approach is that you might not always get the latest version of Wireshark.

[use the apt command](https://itsfoss.com/apt-command-guide/)to check the available version of Wireshark, it is 3.6. However,

[Wireshark 4.0.0 stable version](https://www.wireshark.org/news/20221004.html)was released a few months ago. The new release brings new features, of course.

![Details of Wireshark package available in default Ubuntu repositories displayed with "apt show" command](https://itsfoss.com/content/images/2023/04/wireshark-apt-show.png)

So, what do you do in such a case? Thankfully, Wireshark developers provide an official PPA that you can use to install the latest stable version of Wireshark on Ubuntu and other Ubuntu-based distributions.

I hope you are acquainted with PPA. If not, please [read our excellent guide on PPA to understand it completely](https://itsfoss.com/ppa-guide/).

Open a terminal and use the following commands one by one:

```
sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt update
sudo apt install wireshark
```


Even if you have an older version of Wireshark installed, it will be updated to the newer version.

While installing, you will be asked whether to allow non-superusers to capture packets. Select Yes to allow and No to restrict non-superusers from capturing packets & finish the installation.

### Running Wireshark without sudo

If you have selected **No** in the previous installation, then run the following command as root:

`sudo dpkg-reconfigure wireshark-common`


And select **Yes** by pressing the tab key and then using the enter key:

Since you have allowed the non-superuser to capture packets, you have to add the user to Wireshark group. Use the [usermod command](https://linuxhandbook.com/usermod-command/?ref=itsfoss.com) to add yourself to the Wireshark group.

`sudo usermod -aG wireshark $(whoami)`


Finally, [restart your Ubuntu system](https://itsfoss.com/schedule-shutdown-ubuntu/) to make the necessary changes to your system.

**Trivia:**First released in 1998, Wireshark was initially known as Ethereal. Developers had to change its name to Wireshark in 2006 due to trademark issues.

### Starting Wireshark

Launching Wireshark application can be done from the application launcher or the CLI.

To start from CLI, just type **Wireshark** on your console:

`wireshark`


From GUI, search for Wireshark application on the search bar and hit enter.

![Open Wireshark from Ubuntu Activities Overview](https://itsfoss.com/content/images/2023/04/open-wireshark.png)

Now let’s play with Wireshark.

## Using Wireshark

Wireshark provides a wide range of functions like capturing packets, stop packet capture, save packets etc., with a lot of additional information.

### Capturing packets using Wireshark

When you start Wireshark, you will see a list of interfaces that you can use to capture packets to and from.

There are many types of interfaces available which you can monitor using Wireshark such as, Wired, External devices, etc. According to your preference, you can choose to show specific types of interfaces in the welcome screen from the marked area in the given image below.

![Home screen of Wireshark Network Analyzer, where all the available interfaces are shown](https://itsfoss.com/content/images/2023/04/wireshark-network-analyzer.png)

For instance, I listed only the **Wired** network interfaces.

![Listing only Wired Network interfaces in Wireshark](https://itsfoss.com/content/images/2023/04/wireshark-monitor-only-wired.png)

Next, to start capturing packets, you have to select the interface (which in my case is enp1s0) and click on the Start capturing packets icon as marked in the image below.

![Monitor Selected Interface using Start Capture button](https://itsfoss.com/content/images/2023/04/monitor-selected.png)

You can also capture packets to and from multiple interfaces at the same time. Just press and hold the **CTRL** button while clicking on the interfaces that you want to capture to and from, and then hit the **Start capturing packets** icon as marked in the image below.

![Capture Packets from Multiple Interfaces by selecting them with CTRL and Click and then use the "Start Capturing" buttom](https://itsfoss.com/content/images/2023/04/capture-multiple.png)

### Viewing Packets with details

Next, I tried using `ping google.com`

command in the terminal and as you can see, many packets were captured.

![Packets captured, when a ping to google command is executed in terminal](https://itsfoss.com/content/images/2023/04/capture-packets-live.webp)

Now you can select on any packet to check that particular packet. After clicking on a particular packet, you can see the information about different layers of TCP/IP Protocol associated with it. You can also see the RAW data of that particular packet at the bottom as shown in the image below.

![Detailed information about the packets captured](https://itsfoss.com/content/images/2023/04/packet-details.webp)

**This is why end-to-end encryption is important**

Imagine you are logging into a website that doesn’t use HTTPS. Anyone on the same network as you can sniff the packets and see the username and password in the RAW data. This is why most chat applications use end-to-end encryption and most websites these days use HTTPS (instead of HTTP).

### Stopping packet capture in Wireshark

You can click on the red icon as marked in the given image to stop capturing Wireshark packets.

![Stop Packet Capture using the Stop button](https://itsfoss.com/content/images/2023/04/stop-packets.webp)

### Save captured packets to a file

You can click on the marked icon in the image below to save captured packets to a file for future use.

![Use the Save button to save a packet to a file](https://itsfoss.com/content/images/2023/04/save-a-packet.webp)

Next, select a destination folder, and type the file name and click on Save.

![Save packet to a file by giving it a name and destination](https://itsfoss.com/content/images/2023/04/save-first-packet.png)

Now you can open and analyze the saved packets anytime. To open the file, press **CTRL + o** or go to **File > Open** from Wireshark.

The captured packets should be loaded from the file.

![Open a saved packet from file, by opening them from "File - Open". Or use CTRL + O to select file from file manager](https://itsfoss.com/content/images/2023/04/open-a-saved-packet-file.png)

## More on networking...

Get insights into your network activity and connected devices.

[Monitor Linux Network Usage And Devices With NuttySee what devices are on your network and other network usage with this GUI tool.](https://itsfoss.com/nutty-network-monitoring-tool/)![](https://itsfoss.com/content/images/2023/03/monitor-network-usage-devices-with-nutty.png)


![](https://itsfoss.com/content/images/2023/03/monitor-network-usage-devices-with-nutty.png)

Stay on top of your network bandwidth and speed.

[Monitoring Network Bandwidth and Speed in LinuxBrief: In this article, we list some open source utilities to monitor the network traffic, bandwidth and internet speed in Linux. Monitoring internet speed can be a crucial step in understanding your connection and it can help you find possible problems. It will also help you troubleshoot any c…](https://itsfoss.com/network-speed-monitor-linux/)![](https://itsfoss.com/content/images/wordpress/2019/06/monitor-bandwidth-linux.jpg)


![](https://itsfoss.com/content/images/wordpress/2019/06/monitor-bandwidth-linux.jpg)

Master Linux networking with these essential commands.

[21 Basic Linux Networking Commands You Should KnowA list of basic Linux networking commands that will help you troubleshoot network issues, monitor packets, connect devices, and much more.](https://itsfoss.com/basic-linux-networking-commands/)![](https://itsfoss.com/content/images/wordpress/2016/06/essential-linux-networking-commmands.png)


![](https://itsfoss.com/content/images/wordpress/2016/06/essential-linux-networking-commmands.png)

Wireshark supports many communication protocols. There are many options and features that provide you the power to capture and analyze the network packets uniquely. You can learn more about Wireshark from their [official documentation](https://www.wireshark.org/docs/https://www.wireshark.org/docs/?ref=itsfoss.com).

I hope this tutorial helped you to install Wireshark on Ubuntu. Please let me know your questions and suggestions.