The top panelist of all packets captured by Wireshark.Ģ. In the screenshot above, you can see the Wireshark divided into three panes:ġ. To stop capturing the packets, click the stop button as shown in the following screenshot.

After that, you will see the captured packets in real time.ģ. If there is currently no traffic, you can generate some traffic by visiting any website or accessing a shared file on the network. From the toolbar at the top, click the start button to start capturing packets on the selected interface as shown in the following screenshot. Now the usbmon interfaces should appear in Wireshark.2. Instead, you can give it regular users privileges : Do not execute wireshark in root mode, it may damage files. If the usbmon* files have 'crw-', then it's normal that Wireshark cannot read them because it's not run as root. Now display the permissions of the usbmon interfaces: If the usbmon interfaces don't appear in Wireshark, look for interfaces using dumpcap (the command-line tool of Wireshark): See () for more information about this differentiation. Sudo mount -t debugfs / /sys/kernel/debugįor kernel version 2.6.21 and later, load the loadable module usbmon in the Kernel: `sudo modprobe usbmon` To know the version of your kernel, type:įor versions of the kernel prior to 2.6.21, if debugfs is not already mounted on /sys/kernel/debug, ensure that it is mounted there by issuing the following command: This step depends on the kernel version that is installed on your machine. Important: Logout of your session, then log back in. If not, you can add the group 'wireshark' manually:Īnd then add your username to the group (see above)

You can verify if it’s done correctly by displaying the groups your username is part of: Reconfigure wireshark to allow non-superusers to track packets:Īdd your username to the 'wireshark' usergroup: Sudo apt-get install wireshark libpcap0.8įor Debian, Ubuntu and other Debian derivatives, continue to step 3.įor other Linux based systems or other installation methods, see the Wireshark Wiki, then go to step 6. When you restart your computer, you have to repeat steps 6 and 7 to see the USB interfaces in Wireshark. The first time you follow the tutorial, do all the steps 1 -> 7. Tested on Ubuntu 14.04, but probably works on other distributions since none of the steps are specific to Ubuntu.

Wireshark linux install ubuntu