How to Install Wireshark on Ubuntu

To install Wireshark on Ubuntu use sudo apt update followed by sudo apt install wireshark. In the process of installation you will be asked whether non-superusers should be able to capture packets. The following is dedicated to answering that prompt, explaining its importance, and resolving it if the answer was No or a new user needs to be added later.

How do I install Wireshark on Ubuntu?

Use sudo apt update followed by sudo apt install wireshark. In the process of installation you will be asked whether non-superusers should be able to capture packets.

$ sudo apt update
$ sudo apt install wireshark

The prompt itself, and the process it triggers, is described in the official Wireshark CaptureSetup/CapturePrivileges wiki page pointing Debian and Ubuntu users to "the procedure described in the Wireshark packaging/debian/README.Debian" for granting non-root capture permissions – it is that procedure automated by the installer prompt.

Why does the installer ask about non-superusers capturing packets?

Answering Yes allows to set up file capabilities on dumpcap to make it possible to capture packets by a regular user without having to run Wireshark as root. Answering No restricts capturing to root or the sudo command only.

$ getcap /usr/bin/dumpcap
/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip

This is Wireshark's approach to privilege separation as described in the official CaptureSetup/CapturePrivileges wiki page: "the Wireshark GUI (or the tshark CLI) can run as a normal user while the dumpcap capture utility runs as root" – but in practice on Ubuntu the dumpcap does not run fully as root, only with two capabilities above, and the prompt in question allows to configure just that.

How do I let a non-root user capture packets after installing?

Use sudo usermod -aG wireshark $USER, then logout and login to apply the group membership change. If the setup prompt was missed then use sudo dpkg-reconfigure wireshark-common beforehand.

$ sudo dpkg-reconfigure wireshark-common
$ sudo usermod -aG wireshark $USER

A full logout and login is required to apply the group membership change; use sg wireshark -c wireshark to start Wireshark in a subshell with the new group already enabled, which is helpful to quickly test without logging out.

Why shouldn't I just run Wireshark with sudo?

Running the whole GUI as root makes every Wireshark vulnerability to have full administrator rights. Wireshark instead uses privilege separation approach making it possible for only the small dumpcap capture utility to have elevated permissions.

Wireshark's documentation clearly states this: "it's very insecure running Wireshark this way as every possible Wireshark exploit will be running with the administrator account being able to compromise the whole system," adding that "even an administrator should always run in an account with (limited) user privileges, and only start processes that really need the administrator privileges." Adding the wireshark group above is the intended way to avoid that tradeoff completely.

How do I verify Wireshark can capture packets without root?

Use getcap /usr/bin/dumpcap and check that it contains cap_net_admin and cap_net_raw. Then use wireshark as the normal user and check that the list of capture interfaces is not empty.

$ wireshark --version
$ tshark --version

If the list of interfaces is empty despite getcap listing both capabilities, the most common reason is a group membership not yet applied – logout and login, or test in sg wireshark -c wireshark, before concluding that something is wrong with the capability setup itself.

Our VPS plans and Bare Metal servers allow full control over apt and system groups, making the setup of non-root packet capturing work exactly as explained above.