How can I install Wireshark on Debian 10 (Buster) / Debian 9 (Stretch)?. Wireshark is an open-source network analysis and packet capture tool commonly used in the world of Network Engineers. Wireshark is a cross-platform application and it runs on Linux, Windows, and macOS. You can operate it from a GUI or CLI – Your comfort area is the limit!.

On Ubuntu, check: How to install Wireshark on Ubuntu Desktop

Features of Wireshark

Wireshark comes with a rich set of features like:

  • Deep inspection of hundreds of protocols, with more being added all the time
  • Live capture and offline analysis
  • Standard three-pane packet browser
  • Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others
  • Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
  • The most powerful display filters in the industry
  • Rich VoIP analysis
  • Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
  • Capture files compressed with gzip can be decompressed on the fly
  • Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
  • Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
  • Coloring rules can be applied to the packet list for quick, intuitive analysis
  • Output can be exported to XML, PostScript®, CSV, or plain textInsta

Install Wireshark on Debian 10 (Buster) / Debian 9 (Stretch)

The quickest installation is from Debian repositories.

sudo apt update
sudo apt -y install wireshark

When asked whether to allow non-superusers to capture packets, select your option and finish the installation.

Confirm the version of Wireshark installed on Debian 10 / Debian 9 Desktop.

$ apt policy wireshark
wireshark:
  Installed: 2.6.8-1.1
  Candidate: 2.6.8-1.1
  Version table:
 *** 2.6.8-1.1 500
        500 http://deb.debian.org/debian buster/main amd64 Packages
        100 /var/lib/dpkg/status

Configure and start Wireshark

To be able to capture packets as a normal user, add your user to wireshark group.

sudo usermod -a -G wireshark $USER

Also change dumpcap binary file permissions.

sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

Verify:

$ sudo getcap /usr/bin/dumpcap
/usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip

Starting Wireshark on Debian 10 / Debian 9

You can launch Wireshark on Debian 10 / Debian 9 from the terminal or Applications launcher.

The same can be done from the command line by typing:

$ wireshark

Enjoy using Wireshark on Debian 10 (Buster) / Debian 9.

Other Debian 10 articles:

How To Install VLC Media Player on Debian

How To Install and Configure HAProxy on Debian

How To Install Prometheus and node_exporter on Debian