How to Install and Use Wireshark on Kali Linux

Wireshark is an open-source and powerful network protocol analyzer that is designed for monitoring network traffic over different network interfaces. Wireshark is widely used by system administrators, ethical hackers, and security professionals for network troubleshooting, protocol development, and education. It provides you with the ability to monitor and capture network traffic of data packets coming from a network source.

In this guide, you will learn:

• How to Install Wireshark on Kali Linux
• How to Run Wireshark on Kali Linux
• How to Use Wireshark on Kali Linux
• Conclusion

How to Install Wireshark on Kali Linux

By default, Wireshark is installed on the Kali Linux system, however, if you have accidentally removed the application from the system, use the following command to install it.

Optional: Besides installing Wireshark on Kali Linux, you can also install wireshark-common, a dependency tool for Wireshark that provides you with common data structures and functions used by Wireshark. To install wireshark-common package on Kali Linux, use the following command:

While installing the wireshark-common package on Kali Linux, you may encounter the dpkg error:

To fix the dpkg error, simply run the below-given command:

Once the dpkg is configured, re-run the following command again to install the package on the Kali Linux system:

How to Run Wireshark without sudo privileges

By default, Wireshark allows users to run the application as a root user with sudo privileges. However, you can change the setting and run Wireshark without sudo privileges by running the below-given command:

Once you execute the above-given command, a package configuration window will open, simply press the Enter button on the Ok option to move forward:

Then allow the non-superusers to run Wireshark on Kali Linux by entering with the Yes option:

How to Run Wireshark on Kali Linux

You can run Wireshark on Kali Linux from Terminal or GUI. To run Wireshark on Kali Linux from the terminal, simply use the below-given command:

If you have not enabled the Wireshark to run with non-root users, then use the wireshark command with sudo to run it on your system:

To run Wireshark on Kali Linux from GUI, navigate to the Application menu, search the wireshark, and click on the application to run it on the system:

How to Use Wireshark on Kali Linux

To use Wireshark on Kali Linux, open the application from GUI or Terminal and then select your network interface to monitor network traffic on it. Here, I am going with the eth0 option, which is the default network interface for my system. After selecting the interface, simply click on the Start button with the Shark icon to run the Wireshark and start capturing network traffic over the respected interface:

Note: The network interface for Wi-Fi will be different, normally it will be wlan0 for this case.

Wireshark will start generating the information of captured network traffic on your respective interface:

To have a detailed macroscopic overview of your captured network traffic, click on any captured traffic to view the source and destination of a packet with port and sequence number:

To stop the packet capturing process on Wireshark, use the Stop button (Red button):

How to Remove Wireshark from Kali Linux

You can remove Wireshark from the Kali Linux system anytime by running the following command:

Conclusion

Wireshark is a useful tool used for capturing and analyzing the network traffic over a selected interface. Wireshark is installed on the Kali Linux system by default, however, in case of accidental removal, you can install it from the apt package repository. After the installation, you can run Wireshark on Kali Linux from the terminal and GUI. Once you run it, choose the network interface and click the Start button to start capturing and analyzing network traffic over the respected interface. It is also advised to get proper knowledge about networking to start monitoring the network traffic on Kali Linux.