The first is to use a packet capture program, such as dumpcap or tcpdump, and then later examine the capture files while running Wireshark as a regular user. Two ways to avoid running Wireshark as root are relatively simple. Wireshark has had security problems in the past (more on this later) that allow remote attackers to execute code by sending malicious data, which Wireshark processes. Unfortunately, to run Wireshark and capture live data, you need to run it as root. At a minimum, you'll want libpcap I also suggest installing GnuTLS, PCRE (Perl-Compatible Regular Expressions), and GeoIP if you want to use any of the advanced features. To compile Wireshark, you will need to address some dependencies. Once you have unpacked it, the installation is pretty simple. To build Wireshark from source, you'll need to download it, so you can either pull the latest stable version, or, if you're feeling brave, you can get one of the latest automated builds from SVN.

However, the 1.2 series (and v1.3.0, which might be out by the time this article prints) has a lot of new features, such as protocol support, bug fixes, and GeoIP integration (more on this later). One problem with using a vendor-supplied version of Wireshark is that most vendors ship really old versions of Wireshark (e.g., Fedora 11 ships v1.1.3). On Fedora and most related systems, you can simply run yum: yum install libpcapĭebian is just as easy: apt-get install libpcap0 Wireshark is sometimes split into two separate packages: one consisting of the back-end utilities like tshark and mergecap, and the other consisting of the graphical user interface (GUI). Libpcap comes with most operating systems, and Wireshark is almost always included (at least on Linux and BSD). As long as your OS (e.g., Linux, *BSD, HP-UX, Solaris, Windows, etc.) and software support libpcap, you can sniff packets to your heart's content. Like most (all?) network data capture programs for Linux, Wireshark relies on libpcap, which provides a system-independent interface for capturing packets therefore, you do not need to write custom routines for every packet sniffer (tcpdump, Snort, Wireshark, etc.).

If you've ever had to troubleshoot a network problem or needed to watch a transaction with a server, then this is the tool for you. Wireshark, the packet sniffer formerly known as Ethereal, is a must-have for system administrators.

Wireshark libpcap