- In this video, I'm gonna show you how
to get Wireshark installed and running
on an Ubuntu computer.
In my example, I'm using an Ubuntu virtual machine
running on my Mac.
This is Ubuntu 20.04 but the same process would apply
if you were using a physical laptop or computer.
I'm gonna show you two methods to install Wireshark.
We're gonna use the typical sudo apt install method,
which gives you a version of Wireshark
but not the latest release.
And then I'll show you how to update your references
so that you can install the latest release of Wireshark
on your Ubuntu computer.
I'm gonna keep this video very short,
just show you what's necessary
to get Wireshark up and running.
I've also put the commands below this video
if you wanna reference them.
Okay, let's get started.
(upbeat pop music)
Okay, so the first thing I'm gonna do is open a terminal.
I'll make this a bit bigger
so it's easier to see what's going on.
IP address will show me my IP address.
So here's the IP address of the ethernet interface.
Can I ping sites on the internet?
Yes, I can ping google.com, as an example,
so I'll clear the screen.
I'm gonna use sudo apt update to update my reference.
Because I'm using sudo, which allows me
to run this command with root privileges,
I have to put in my password.
And as you can see, the Ubuntu references are being updated.
Good practice to always do that first.
Okay, so references have been updated.
I will clear the screen again and I'll install Wireshark
by using the command, sudo apt install wireshark.
I'll say yes to install the software.
So this is the easy method, basically.
It's gonna allow me to install Wireshark,
but I won't get the latest release of Wireshark.
Now in the past, you had to run Wireshark
as root or with root privileges
to be able to capture traffic off an interface.
Nowadays, you can allow non-superusers to capture packets.
Basically, this allows members
of the Wireshark group to capture packets.
It's recommended over the alternative
of running Wireshark or TShark directly as root
because less of the code will run with elevated privileges.
We're also told that enabling this feature
may be a security risk, so it's disabled by default.
If in doubt, it's suggested that you leave it disabled.
So I'm gonna do what they say here
and leave it disabled.
But I'm gonna show you in a moment what happens
when I try and run Wireshark as a non-root user?
We are basically given steps to enable this
at a later time if we want to.
So for now, I'm gonna say no.
Wireshark is now installed on this Ubuntu computer.
And there you go.
Wireshark is installed.
Notice what happens when I try
and run Wireshark without sudo.
It seems to be okay, but I'll try and capture traffic
from my ethernet interface.
And notice we're told that to the capture session
could not be initiated because we don't have privileges.
And we're given a list of steps to follow
to enable this feature.
So we can run this command,
reconfigure wireshark-common,
which will display that prompt that I showed you previously
that allows you to say yes or no
to allow non-root users to capture packets.
You would select yes in response to the question,
should non-superusers be able to capture packets,
and then you need to add your user account
to the Wireshark group by running this command.
So if you ever wanted to do that later, there are the steps.
You could take a screenshot of that as an example,
take note of the commands and then run them
if you want to allow non-root to users to capture packets.
I'm gonna click OK,
And I'm gonna shut Wireshark down at this point,
and I'm gonna run sudo wireshark to start Wireshark again,
and now notice I see a bunch of traffic
on the ethernet interface.
And if I click Start capture,
I need to put in my Mac password
because this is running in a virtual machine.
And notice there I can see a whole bunch of traffic.
So a lot of traffic being seen in the network at this point.
Just make these a bit bigger.
So there you go,
a whole bunch of traffic from various sources
to various destinations.
So the network is very busy, but I could, as an example,
filter for ICNP traffic, and I'm seeing some ICNP traffic.
But what I'll do here is open a new window,
make this a bit bigger once again,
and what I'll do is ping the google.com.
So the ping succeed, and notice here
I can see pinged traffic from 192.168.128,
which going back to my terminal
and using the command IP address shows me
that that is the IP address of the local Ubuntu computer.
So this Ubuntu computer is pinging google.com.
I can see layer two information.
Notice it's a VM-ware Mac address.
I'm running Ubuntu in a virtual machine on my Mac.
So the VMware is sending traffic to a Cisco router.
That is my default gateway for my home network.
So source and destination, ethernet, Mac addresses,
here are the IP addresses,
so I can see the local IP address, 192.168.128,
which is my Ubuntu VM, is pinging google.com,
and scrolling down, I can see ping requests,
and then next packet is echo reply or ping reply.
So I'm already capturing traffic on my network.
Okay, I'll close this down, and I won't save the capture.
I want to show you that the version of Wireshark
that I'm using is not the latest release.
So apt show wireshark shows me that the version
that I'm using is 3.2.3-1
but if I go to wireshark.org,
so on the wireshark.org website, if I click Download,
you'll notice that the latest release is 3.2.5,
released on the 1st of July, 2020.
So if you happy to run this older release of Wireshark,
you don't have to do anything else.
I mean, you can see that I'm capturing packets
off my network.
I can filter for various traffic types.
So as an example, if I filter for STP,
that spanning tree, which is used by switches
to ensure that there are no loops on the network.
So I can see that I'm running rapid spanning tree
in this example.
I could capture other packets on the network.
So if you're happy using a slightly older release
of Wireshark, notice here, 3.2.3,
then that's all you need to do.
You've got Wireshark running on your computer.
So for a lot of people, that's fine.
But if you want to get the latest release
of Wireshark 3.2.5, what you need to do
is shut Wireshark down.
I'll clear the screen here.
And then you need to add a repository.
So I'm gonna use this command,
sudo add-apt-repository ppa:wireshark-dev/stable.
Basically, this is gonna allow us
to get the latest releases of a Wireshark.
So we're told that here,
latest stable releases of Wireshark
back-ported from Debian package versions.
Press Enter to continue.
I'm gonna do that.
Ubuntu is updated.
Okay, so now that that's been done,
I can type sudo apt update,
clear the screen,
and now I'll simply install Wireshark once again.
Okay, all you need to do now is re-install Wireshark.
It'll automatically update the Wireshark installation.
So I've used the command, sudo app
to apt install Wireshark.
Yes to continue the installation.
This will now download the latest release of Wireshark
and update the current Wireshark that I'm using.
Okay, I'll clear the screen.
So now I'll use the command, apt show wireshark,
and as you can see, we're using 3.2.5.1.
This is the latest release of Wireshark.
Sudo wireshark to start it.
Go to Help, About Wireshark 3.2.5
is what I'm using.
So I'm basically using the latest release of Wireshark
on my Ubuntu computer.
So previously, I had an older release.
Now I'm using the latest release.
So once again, if I ping google.com
from my Ubuntu virtual machine,
I can see those ICNP messages
from my local computer to google.com.
Okay, so in this video,
I just wanted to show you how to get Wireshark installed.
I'll talk about some of the filters
and options in Wireshark later,
but I just wanted to show you how
to get started with Wireshark.
If you enjoyed this video, please consider liking it.
Please consider subscribing to my YouTube channel,
and please click on the bell to get notifications.
I'm David Bombal,
and I want to wish you all the very best.
♪ They both deserve it all ♪
(upbeat pop music)