Optionally, you can capture packets using dumpcap (the packet capture engine), save them and use Wireshark for further analysis. Wireshark also has various command line options, which will be covered in a separate article. The recommended way to do so is to use gksudo wireshark. You may require administrative privileges. Windows: Start Wireshark by clicking its icon. Welcome to the exciting world of network troubleshooting and protocol analysis. Your system is ready for the first capture.

Ubuntu: Search for Wireshark under Ubuntu Software Centre, and click to install or use the command line: So go ahead and install the libraries, which are a must to run Wireshark. This is primarily due to the ability of winpcap to capture network packets. Here is an interesting point to remember for those paranoid about security: some of the websites, such as McAfee SiteAdvisor, rate winpcap libraries as security risk. Windows: Download the latest 32- or 64-bit version installable, which is compatible with your Windows version double-click on it and follow the instructions.ĭuring this installation, you will be asked to confirm installation of winpcap libraries.

Wireshark installation is very simple and straightforward. Here, I have taken the liberty of mentioning only the important or relevant modules and their functions for easy understanding. To provide the desired functions, Wireshark uses a number of different modules integrated together by the Wireshark core. This series of articles on Wireshark will familiarise readers with the Wireshark GUI and analysing various TCP/IP protocols by means of captured packets, explaining the features of Wireshark and discuss various scenarios to locate network related problems. So Wireshark is an absolute must for any networking professional!

Over and above this, the tool is available under GNU GPL (read, free). All these features are an inherent part of Wireshark.

Download wireshark essential training