That post will provide you with a great explanation on what Wireshark is and how to use it to troubleshoot network communications. If you haven't used Wireshark before and aren't familiar with the basics, we strongly suggest you first take a few minutes to read the Tech Support Corner: Using Wireshark as a Supplemental Troubleshooting Tool post. ĭo you ever find yourself in need of troubleshooting Network Traffic using Wireshark, but you are concern with at how much storage the captures will take on the system? Well, you are in luck because today, we will learn how to write a simple script for running custom Wireshark captures.

Wireshark also provides options for specifying capture filters (for defining a smaller subset of data to be captured that you're interested in) or you can capture all traffic and apply a display filter to narrow down the traffic that is visible.Ĭontinuing our Tech Support Corner blog series, this blog post covers how to go even further using Wireshark by defining scripted custom Wireshark captures for specific use cases, which is helpful for capturing infrequent issues without wasting a lot of unnecessary hard drive space. Our support engineers find it to be invaluable for troubleshooting Ethernet communications issues, as it provides visibility into more than just the protocol data packets, including handshaking calls and responses. When you're back in it should let you start sniffing without any fuss about being root.As you may be aware, Wireshark is an incredibly useful freeware tool for capturing network traffic on a computer. Run this: sudo adduser $USER wiresharkĪnd restart or log out. Then you just need to add the user to that group. Technically any person with access to a computer logged in with a wireshark account will be able to sniff. This is obviously more secure than just letting anybody sniff but does mean there's no password checking. Anybody in that group will be able to sniff without being root. That's what we're aiming for, so select Yes and hit return. This will ask you if you want to allow non-root user to be able to sniff. In a terminal (very important that you're in a terminal, not just the Alt+F2 dialogue) run this: sudo dpkg-reconfigure wireshark-common

The bit that normally needs root is the packet collection application and this can be configured to allow certain people to use it without sudo, gksu, etc.

Start wireshark capture