Wireshark

Installation of Wireshark in Linux

Let's take an example. Ubuntu

sudo apt update
sudo apt install wireshark

Press Y + Enter

When will a dialog box with a question appear?

Should non-superusers be able to capture packets?

Choose. Yes

Once Wireshark is installed, add your user to the wireshark and check the results.

sudo usermod -aG wireshark $(whoami)
groups $(whoami)

andrei : andrei sudo docker wireshark

Restart the computer.

sudo reboot

Example 1

The task is to check whether the developer has removed outdated Polling by FTP.

Checking logs is not suitable for us, since the developer could delete the entry in the log, but forget to delete the Polling itself.

Therefore, you need to check the real data exchange, for which Wireshark is perfect.

Launch Wireshark. Use the filter ftp-data. Launch client. Take a closer look at what messages Wireshark captures.

Turn off the old client. Remove the database if it is shared. Restart Wireshark. Use the filter ftp-data. Take a closer look at what messages Wireshark captures.

No ftp packets have been sent. It's calm. Let's take the job. Let's accept the story.

Composite filters in Wireshark

It is often necessary to impose several conditions simultaneously. In this case, logical operators are provided.

Exchange between specific hosts

If we are only interested in data exchange between two specific hosts, we use filters. ip.src provide a source address and ip.dst to give you the destination address.

Suppose that 10.6.1.2 is sent to 10.6.1. 3

Use the filter.

ip.src==10.6.1.2 and ip.dst==10.6.1.3

Someone can find instructions where the filter is used. I don’t know why it is ip.src==10.6.1.2/4 and ip.dst=10.6.1.3/4

Installation at Ubuntu

sudo apt install -y wireshark

Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: libqt5multimedia5 libqt5multimedia5-plugins libqt5multimediagsttools5 libqt5multimediawidgets5 libsmi2ldbl libspandsp2 libwireshark-data libwireshark13 libwiretap10 libwsutil11 wireshark-common wireshark-qt Suggested packages: snmp-mibs-downloader geoipupdate geoip-database geoip-database-extra libjs-leaflet libjs-leaflet.markercluster wireshark-doc The following NEW packages will be installed: libqt5multimedia5 libqt5multimedia5-plugins libqt5multimediagsttools5 libqt5multimediawidgets5 libsmi2ldbl libspandsp2 libwireshark-data libwireshark13 libwiretap10 libwsutil11 wireshark wireshark-common wireshark-qt 0 upgraded, 13 newly installed, 0 to remove and 22 not upgraded. Need to get 22.1 MB of archives. After this operation, 117 MB of additional disk space will be used. Get:1 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libqt5multimedia5 amd64 5.12.8-0ubuntu1 [283 kB] Get:2 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libqt5multimediawidgets5 amd64 5.12.8-0ubuntu1 [36.8 kB] Get:3 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libqt5multimediagsttools5 amd64 5.12.8-0ubuntu1 [104 kB] Get:4 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libqt5multimedia5-plugins amd64 5.12.8-0ubuntu1 [197 kB] Get:5 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libsmi2ldbl amd64 0.4.8+dfsg2-16 [100 kB] Get:6 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libspandsp2 amd64 0.0.6+dfsg-2 [272 kB] Get:7 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libwireshark-data all 3.2.3-1 [1,456 kB] Get:8 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libwsutil11 amd64 3.2.3-1 [61.1 kB] Get:9 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libwiretap10 amd64 3.2.3-1 [199 kB] Get:10 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 libwireshark13 amd64 3.2.3-1 [15.2 MB] Get:11 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 wireshark-common amd64 3.2.3-1 [441 kB] Get:12 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 wireshark-qt amd64 3.2.3-1 [3,774 kB] Get:13 http://fi.archive.ubuntu.com/ubuntu focal/universe amd64 wireshark amd64 3.2.3-1 [5,088 B] Fetched 22.1 MB in 2s (9,459 kB/s) Preconfiguring packages ... Selecting previously unselected package libqt5multimedia5:amd64. (Reading database ... 445160 files and directories currently installed.) Preparing to unpack .../00-libqt5multimedia5_5.12.8-0ubuntu1_amd64.deb ... Unpacking libqt5multimedia5:amd64 (5.12.8-0ubuntu1) ... Selecting previously unselected package libqt5multimediawidgets5:amd64. Preparing to unpack .../01-libqt5multimediawidgets5_5.12.8-0ubuntu1_amd64.deb ... Unpacking libqt5multimediawidgets5:amd64 (5.12.8-0ubuntu1) ... Selecting previously unselected package libqt5multimediagsttools5:amd64. Preparing to unpack .../02-libqt5multimediagsttools5_5.12.8-0ubuntu1_amd64.deb ... Unpacking libqt5multimediagsttools5:amd64 (5.12.8-0ubuntu1) ... Selecting previously unselected package libqt5multimedia5-plugins:amd64. Preparing to unpack .../03-libqt5multimedia5-plugins_5.12.8-0ubuntu1_amd64.deb ... Unpacking libqt5multimedia5-plugins:amd64 (5.12.8-0ubuntu1) ... Selecting previously unselected package libsmi2ldbl:amd64. Preparing to unpack .../04-libsmi2ldbl_0.4.8+dfsg2-16_amd64.deb ... Unpacking libsmi2ldbl:amd64 (0.4.8+dfsg2-16) ... Selecting previously unselected package libspandsp2:amd64. Preparing to unpack .../05-libspandsp2_0.0.6+dfsg-2_amd64.deb ... Unpacking libspandsp2:amd64 (0.0.6+dfsg-2) ... Selecting previously unselected package libwireshark-data. Preparing to unpack .../06-libwireshark-data_3.2.3-1_all.deb ... Unpacking libwireshark-data (3.2.3-1) ... Selecting previously unselected package libwsutil11:amd64. Preparing to unpack .../07-libwsutil11_3.2.3-1_amd64.deb ... Unpacking libwsutil11:amd64 (3.2.3-1) ... Selecting previously unselected package libwiretap10:amd64. Preparing to unpack .../08-libwiretap10_3.2.3-1_amd64.deb ... Unpacking libwiretap10:amd64 (3.2.3-1) ... Selecting previously unselected package libwireshark13:amd64. Preparing to unpack .../09-libwireshark13_3.2.3-1_amd64.deb ... Unpacking libwireshark13:amd64 (3.2.3-1) ... Selecting previously unselected package wireshark-common. Preparing to unpack .../10-wireshark-common_3.2.3-1_amd64.deb ... Unpacking wireshark-common (3.2.3-1) ... Selecting previously unselected package wireshark-qt. Preparing to unpack .../11-wireshark-qt_3.2.3-1_amd64.deb ... Unpacking wireshark-qt (3.2.3-1) ... Selecting previously unselected package wireshark. Preparing to unpack .../12-wireshark_3.2.3-1_amd64.deb ... Unpacking wireshark (3.2.3-1) ... Setting up libwsutil11:amd64 (3.2.3-1) ... Setting up libspandsp2:amd64 (0.0.6+dfsg-2) ... Setting up libqt5multimedia5:amd64 (5.12.8-0ubuntu1) ... Setting up libsmi2ldbl:amd64 (0.4.8+dfsg2-16) ... Setting up libwiretap10:amd64 (3.2.3-1) ... Setting up libqt5multimediawidgets5:amd64 (5.12.8-0ubuntu1) ... Setting up libwireshark-data (3.2.3-1) ... Setting up libqt5multimediagsttools5:amd64 (5.12.8-0ubuntu1) ... Setting up libqt5multimedia5-plugins:amd64 (5.12.8-0ubuntu1) ... Setting up libwireshark13:amd64 (3.2.3-1) ... Setting up wireshark-common (3.2.3-1) ... Setting up wireshark-qt (3.2.3-1) ... Setting up wireshark (3.2.3-1) ... Processing triggers for libc-bin (2.31-0ubuntu9.2) ... Processing triggers for man-db (2.9.1-1) ... Processing triggers for shared-mime-info (1.15-1) ... Processing triggers for desktop-file-utils (0.24-1ubuntu3) ... Processing triggers for mime-support (3.64ubuntu1) ... Processing triggers for hicolor-icon-theme (0.17-2) ... Processing triggers for gnome-menus (3.36.0-1ubuntu1) ...

Article author: Andrei Olegovich