Results 1 to 8 of 8

Thread: Setting Up Wireshark Capture

  1. #1
    Join Date
    Sep 2010
    Beans
    27
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Setting Up Wireshark Capture

    I have some question regarding wireshark.
    I saw this on their support page :
    On Linux, you need to have "packet socket" support enabled in your kernel; see the "Packet socket" item in the Linux "Configure.help" file. Your distribution might enable this by default in the kernel.
    Can anyone tell me where in Ubuntu is the Configure.help mentioned.

    That's all for now.
    thanks.
    Last edited by lisati; October 24th, 2011 at 09:08 AM. Reason: Normalize font, add quote tags

  2. #2
    Join Date
    Jun 2007
    Location
    Porirua, New Zealand
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Setting Up Wireshark Capture

    Wireshark is available in the repos. If you install it from synaptic or software centre, you shouldn't need to worry about where the config. files are.
    Forum DOs and DON'Ts
    Never assume that information you find using a search engine is up-to-date.

  3. #3
    Join Date
    Sep 2010
    Beans
    27
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Setting Up Wireshark Capture

    Yeah.. But it says I could not capture anything : "You didn't specify an interface on which to capture packets."

    And when I clicked on interface list.. It doesnt show anything.

    I ran Ubuntu 10.10.
    Is there any other package/dependecies to set up ?

    Thank u.

  4. #4
    Dangertux is offline Chocolate Ubuntu Mocha Blend
    Join Date
    Jun 2011
    Location
    Atlanta Georgia
    Beans
    1,771
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: Setting Up Wireshark Capture

    try running it with

    Code:
    gksudo wireshark
    Hope that helps.

  5. #5
    Join Date
    Nov 2006
    Location
    Craggy Island.
    Beans
    Hidden!
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: Setting Up Wireshark Capture

    If your still having trouble,
    you could also capture on command line and view in wireshark.

    eg

    Code:
    sudo tcpdump -w trace.pcap -s 1600 -i eth0
    This will run tcpdump where
    -w specifies a file to dump to, (in this case trace.pcap) which wireshark can open,
    -s changes the capture size from default 64 bytes to 1600. If you don't change this all packets will appear truncated.
    -i specifies an interface , in this case, eth0.

    You can get crafty with your capture command line by specifying port numbers, protocol types, host names or IP addresses etc.

    When the trace has been ran, control c to stop and open using wireshark.
    Wireshark is good however, for watching packets in realtime,
    You can do that with tcpdump also using the -v (verbose) option, however, thats not as good as wireshark
    You can tell a man who boozes by the company he chooses, as the pig got up and slowly walked away.

  6. #6
    Join Date
    Sep 2011
    Location
    India
    Beans
    123
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Setting Up Wireshark Capture

    After installing the wireshark, select the interface to capture the network. Then click on start capture .. to capture the packets ..

  7. #7
    Join Date
    Dec 2011
    Beans
    30

    Re: Setting Up Wireshark Capture

    Hey, I want the same thing, to be able to find the configure.help file, again for wireshark, but it would be nice to know about it for future reference.

  8. #8
    Join Date
    Nov 2012
    Beans
    2

    Re: Setting Up Wireshark Capture

    You can also see the small tutorials on tcpdump and wireshark:

    Use tcpdump to capture in a pcap file (wireshark dump)

    Remote packet capture using WireShark & tcpdump

    Cheers,
    Linux Explore | Exploring Linux

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •