The main feature that you’ll use frequently with Wireshark is the capture. I won’t explain everything in this article, but I absolutely want to explain how to capture the network traffic and analyzer the results, so let’s get right to it.

And you have the full menu for all the ninja features included in this tool. You also need to pick a network interface to listen to (in general, it will be eth0). You’ll find the main actions in the shortcut bar at the top of the screen. When you start Wireshark for the first time, the interface looks like this: Let’s browse the most important features together. If you haven’t used this tool, the difficulty is probably starting now to understand exactly what it does and how to use it. Installing Wireshark is pretty straightforward. To get it back on your system How To Use Wireshark on Kali Linux Wireshark is available in the default repositories, so you can open a terminal and type: If, for any reason, Wireshark is not available in the main menu, you can always install it manually. You can also use the search engine in the main menu to find it faster, or create a shortcut somewhere to have it at hand all the time. Find Wireshark at the end of the list and click on it.Go to Sniffing & Spoofing (number 9 in the current release).$ tshark -c 100 -i 10 -w usbmon1-dump.Wireshark is included by default on Kali Linux, whatever version you are using, it’s even pre-installed on the Live system, so there is no need to install anything to use Wireshark.Īs Kali Linux comes with a lot of tools included, you may have a hard time to find Wireshark in the main menu, here is how to start the application: pcap to save the capture in pcap format that can be imported into Wireshark GUI. Use -c to limit the number of rows, and -w. udpdump (UDP Listener remote capture)īy trial and error, we find that it's device #10 we are interested in capturing, so we run: $ tshark -i 10ġ 0.000000 host → 1.2.0 USB 64 GET DESCRIPTOR Request DEVICEĢ 0.000160 1.2.0 → host USB 82 GET DESCRIPTOR Response DEVICE dpauxmon (DisplayPort AUX channel monitor capture)ġ7. It looks like it's tshark command in charge of capturing stuff from the command line.įirst, we need to identify the device we want to capture.

How to use wireshark command line