Offensive Security Researcher & Quantum Cryptography Analyst

Wireshark: Complete Guide to Packet Analysis and Network Troubleshooting Using Kali Linux

Abdul Wahab Junaid
Wireshark: Complete Guide to Packet Analysis and Network Troubleshooting Using Kali Linux

Wireshark is a free, open-source graphical network protocol analyzer used to capture and interactively browse traffic running on a computer network. It was originally created in 1998 under the name Ethereal and was renamed Wireshark in 2006. Wireshark uses the libpcap/WinPcap/Npcap capture libraries to grab raw packets from a network interface (or reads them from a previously saved capture file) and then passes them through its powerful dissection engine, which decodes hundreds of network protocols — from Ethernet and IP up through HTTP, TLS, DNS, SMB, and application-specific proprietary protocols.

Wireshark is used by network administrators for troubleshooting, security engineers for traffic inspection and malware analysis, penetration testers for protocol abuse and credential harvesting review, developers for debugging network-facing applications, and forensic investigators for reconstructing network events. Its key strengths are: a rich graphical interface with color-coded packet lists, an extremely powerful two-tier filter system (capture filters and display filters), the ability to follow entire TCP/UDP/HTTP streams as reconstructed conversations, deep protocol dissection with field-by-field breakdown, and extensibility through plugins and Lua scripting.

In Kali Linux, Wireshark is a first-class citizen and is included in the default Kali toolset (or easily installable), since packet-level visibility underpins nearly all network penetration testing and network forensics work.

How to Install

Wireshark comes pre-installed on many Kali Linux images, but if it is missing or you want to reinstall/update it, use the following:

# Update package lists
sudo apt update

# Install Wireshark
sudo apt install wireshark -y

# During installation, you will be prompted:
# "Should non-superusers be able to capture packets?" -> select <Yes>
# This configures dumpcap with the right group permissions.

To allow a non-root user to capture packets without running Wireshark as root (best practice, since running GUI apps as root is discouraged):

# Add your user to the wireshark group
sudo usermod -aG wireshark $USER

# Log out and log back in (or reboot) for the group change to take effect
newgrp wireshark

Verify the installation and check the version:

wireshark --version

Expected output:

Wireshark 4.2.5 (Git commit unknown)

Compiled (64-bit) using GLib 2.78.4, with Qt 5.15.13, with libpcap, with POSIX
capabilities, with libnl 3, with GLibc 2.37, with zlib 1.3, with LZ4, with
Zstd, with LZMA, with Brotli, with Snappy, with nghttp2, with nghttp3, with
libgcrypt 1.10.3, with MaxMind DB resolver, with AirPcap, with GnuTLS 3.8.3
and PKCS #11 support, with Lua 5.2.4.
...

You can also install it from source or via Flatpak, but apt is the standard method on Kali.

Syntax

Wireshark can be launched purely as a GUI, or launched from the command line with options that pre-configure the session:

wireshark [OPTIONS] [ <infile> ]

Examples of syntax patterns:

wireshark                                  # Launch GUI, choose interface manually
wireshark -i eth0                          # Launch and start capturing on eth0
wireshark -i eth0 -k                       # Launch, auto-start capture (-k = start immediately)
wireshark -r capture.pcap                  # Open an existing capture file
wireshark -r capture.pcap -Y "http"        # Open file and apply a display filter

All Command-Line Options (Kali Linux)

The following is the full set of command-line switches supported by the wireshark binary:

-h, --help                     Display help information and exit
-v, --version                  Display version information and exit

Capture interface:
  -i <interface>                Name or index of capture interface
  -f <capture filter>           Packet filter in libpcap filter syntax (BPF)
  -s <snaplen>                  Packet snapshot length (bytes to capture per packet)
  -p                            Don't capture in promiscuous mode
  -I                            Capture in monitor mode (for wireless)
  -B <buffer size>              Capture buffer size (in MB, Win32 only)
  -y <link type>                Link layer type
  -D                            Print list of interfaces on which Wireshark can capture
  -L                            Print list of link-layer types supported by interface

Capture stop conditions:
  -c <packet count>              Stop after n packets
  -a <autostop cond.>            Duration:NUM, filesize:NUM, files:NUM

Capture output:
  -b <ringbuffer opt.>            duration:NUM, filesize:NUM, files:NUM

Input file:
  -r <infile>                    Set the filename to read from (no auto-detect)

Processing:
  -R <read filter>                Packet filter in Wireshark display filter syntax
  -Y <display filter>             Post-capture / read display filter (preferred over -R)
  -n                              Disable all name resolution
  -N <name resolve flags>         Enable specific name resolution
  -d <layer type>==<selector>,<decode-as protocol>  Decode as

User interface:
  -C <config profile>             Start with specified configuration profile
  -Y <display filter>             Start with the given display filter applied
  -g <packet number>               Go to specified packet number after "-r"
  -J <jump filter>                  Jump to the first packet matching the filter
  -j                                Search backwards for a matching packet
  -m <font>                         Set the font name used for most text
  -t a|ad|d|dd|e|r|u|ud              Format of time stamps
  -X <key>:<value>                   Extension options
  -z <statistics>                    Show various statistics

Output:
  -w <outfile|->                    Set the output filename (or '-' for stdout)

Miscellaneous:
  -q                                 Combined with a capture, don't display packets
  -Q                                 Quit after capturing (with -c/-a)
  -k                                 Start capturing immediately
  -K <keytab>                        Kerberos keytab file
  -o <preference/recent setting>     Set a preference/recent value
  -A <capture autostop>              Auto-stop conditions during capture

Note: Many of these overlap with tshark, since both share the same underlying dissection engine.

Basic Usage (Expected Output in Bash)

Listing available capture interfaces:

wireshark -D

Expected output:

1. eth0
2. wlan0
3. lo (Loopback)
4. any
5. bluetooth0
6. nflog
7. nfqueue

Starting a live capture directly from the terminal (GUI window opens, capturing on eth0):

wireshark -i eth0 -k

Expected terminal behavior:

(Wireshark GUI window opens and begins live packet capture on eth0 immediately;
 no further terminal output is printed unless an error occurs.)

Opening a saved capture file with a filter pre-applied:

wireshark -r sample.pcap -Y "tcp.port == 443"

Expected behavior:

(GUI opens, loads sample.pcap, and the packet list is pre-filtered
 to show only packets where TCP port 443 is involved.)

Practical Examples with Output

Example 1: Capture 100 packets on eth0 and save to a file

wireshark -i eth0 -c 100 -w capture1.pcapng

Output (terminal, while GUI captures):

Capturing on 'eth0'
100 packets captured and saved to capture1.pcapng

Example 2: Open a pcap and apply a display filter for DNS traffic

wireshark -r traffic.pcap -Y "dns"

Result in GUI packet list (representative rows):

No.  Time      Source        Destination    Protocol  Length  Info
12   0.452110  192.168.1.10  8.8.8.8        DNS       74      Standard query 0x1a2b A example.com
13   0.489321  8.8.8.8       192.168.1.10   DNS       90      Standard query response 0x1a2b A 93.184.216.34

Example 3: Follow a TCP stream from the GUI

Right-click a TCP packet -> Follow -> TCP Stream

Output window (reconstructed conversation):

GE T /index.html HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1256

<html>...</html>

Example 4: Capture only HTTP traffic using a capture filter

wireshark -i eth0 -f "tcp port 80"

Result: only TCP port 80 packets appear in the live capture.

Example 5: Export displayed packets to a new pcap file

File -> Export Specified Packets -> (choose "Displayed" range) -> Save as filtered.pcapng

Example 6: Extract HTTP objects (e.g., downloaded files) from a capture

File -> Export Objects -> HTTP...

Output (Export Objects window):

Packet   Hostname        Content Type              Size   Filename
45       example.com     image/png                 34 KB  logo.png
102      example.com     application/octet-stream  1.2MB  update.exe

Example 7: Apply a complex display filter combining protocol and IP

ip.addr == 192.168.1.50 && tcp.flags.syn == 1 && tcp.flags.ack == 0

Result: shows only SYN (connection-initiation) packets originating to/from 192.168.1.50.

Example 8: Statistics -> Protocol Hierarchy

Statistics -> Protocol Hierarchy

Output (representative):

Protocol                     % Packets   Packets   Bytes
Frame                        100.0       15234     12.4 MB
  Ethernet                   100.0       15234     12.4 MB
    Internet Protocol         98.7       15036     12.1 MB
      Transmission Control    76.2       11607      9.8 MB
        Hypertext Transfer     12.1       1843       1.9 MB
      User Datagram Protocol  22.5        3429      2.3 MB
        Domain Name System    18.9        2880      1.1 MB

Example 9: Statistics -> Conversations

Statistics -> Conversations -> TCP tab

Output (representative table):

Address A        Address B        Packets   Bytes    Duration
192.168.1.10:5321  93.184.216.34:443  842   612 KB   14.2s
192.168.1.10:5322  151.101.1.69:80    120   88 KB    3.1s

Example 10: Use “Decode As” to force interpretation of a non-standard port

Right-click packet -> Decode As... -> set port 8080 as HTTP

Result: traffic on port 8080 is now dissected and displayed as HTTP instead of raw TCP payload bytes.

Common Use Cases

Automation with Bash

While Wireshark itself is GUI-centric, it can be invoked from scripts for capture setup, and its companion CLI tools (tshark, dumpcap, capinfos, mergecap, editcap) are commonly used for automation. A simple wrapper script:

#!/bin/bash
# auto_capture.sh - starts a timed Wireshark capture and opens it when done

IFACE="eth0"
DURATION=60
OUTFILE="/tmp/capture_$(date +%Y%m%d_%H%M%S).pcapng"

echo "[*] Starting ${DURATION}s capture on ${IFACE}..."
dumpcap -i "$IFACE" -a duration:"$DURATION" -w "$OUTFILE"

echo "[*] Capture complete: $OUTFILE"
echo "[*] Opening in Wireshark..."
wireshark -r "$OUTFILE" &

Batch-processing multiple pcap files by opening each with a pre-set filter, one after another, for manual review:

#!/bin/bash
for pcap in /var/captures/*.pcap; do
    echo "[*] Loading $pcap for review..."
    wireshark -r "$pcap" -Y "tcp.analysis.retransmission or tcp.flags.reset==1"
done

Since heavy automation is generally delegated to tshark, see the Tshark.md file for scripting-heavy pipelines; Wireshark itself is best automated only for launching pre-configured, filtered GUI sessions.

Tips and Best Practices

Troubleshooting

Problem: “You don’t have permission to capture on that device” / interfaces greyed out. Solution: Ensure your user is in the wireshark group (sudo usermod -aG wireshark $USER), then log out/in. Confirm dumpcap has the correct capabilities:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

Problem: No interfaces are listed at all. Solution: Confirm dumpcap is installed and check interface status with ip link show. Also verify Wireshark was installed with capture support enabled.

Problem: Wireshark crashes or freezes on very large capture files. Solution: Use tshark or editcap/mergecap to split or filter the file down to a manageable size before opening it in the GUI; increase system RAM or use Statistics -> Capture File Properties selectively rather than loading everything into the packet list.

Problem: Display filter turns pink/red (invalid syntax). Solution: Check for correct field names via autocomplete; remember display filter syntax differs from BPF (e.g. ip.addr not host).

Problem: TLS traffic cannot be decrypted. Solution: Provide the session key log file via Edit -> Preferences -> Protocols -> TLS -> (Pre)-Master-Secret log filename, pointing to a file generated by setting the SSLKEYLOGFILE environment variable in the client application.

Problem: High CPU/memory usage during long captures. Solution: Apply strong capture filters, disable unnecessary protocol dissection (Analyze -> Enabled Protocols), and disable “Update list of packets in real time” for very high-throughput captures.

References

Exit mobile version