Wireshark install and capture permissions
You get to know Wireshark’s parts (the interface, tshark, dumpcap) and which permission capturing needs, list the installed package and the interfaces, make your first capture with Wireshark’s capture engine dumpcap, open it in the interface and prepare a capture of exactly the requested number of packets yourself.
Level 101 · 40 min
You have just joined the security operations centre (SOC) of Northwind Logistics. Your first job is to get to know the tool the team uses every day: Wireshark. It records the traffic crossing the network and opens every packet layer by layer.
Analogy: your network card is like a mailbox. Wireshark photocopies every envelope passing through it and lays the copies on your desk. It doesn’t touch the envelopes, it only shows copies. On a network each envelope is called a packet.
Wireshark isn’t one program but a family: the graphical interface wireshark, the command-line version tshark and the small engine that does the actual capturing, dumpcap. The figure shows a packet’s journey from the network card to your screen.
Important: capturing traffic on someone else’s network without permission is a crime under laws protecting the privacy of communications. Here you are on a closed lab network that belongs only to you; at work, too, capturing is done only with written permission and on networks you are responsible for.
In the first steps the commands are ready. Towards the end of the lesson the help fades; in the last steps you only see the goal.
What you will do in this lesson
- The family members and their versions
- How was the package installed?
- Who captures? dumpcap’s permissions
- Which interfaces can you listen on?
- The first capture: dumpcap
- Open the capture in the interface
- Your card’s identity
- Exactly the requested number of packets
- A safe installation note
- Short quiz
Skills you will earn
- Knowing the Wireshark family (wireshark, tshark, dumpcap)
- Verifying the Wireshark package installation
- Setting capture permissions right (wireshark group, dumpcap capabilities)
- Finding capture interfaces and the MAC address
- Capturing with dumpcap by time and packet count
- Opening a capture file in Wireshark
Wireshark fundamentals · The Wireshark interface: packet list, details, bytes; columns and profiles →
Start for free