There are many great blog posts already on understanding Snort rules, such as this one by Rapid7, so I won’t try to rehash them here. Then click the green shark fin icon to start capturing packets.Snort rules are considered the gold standard of network intrusion detection signatures, and because of that, new analysts need to learn how to read and understand their logic. In my case I chose the wireless interface wlp3s0. In the wireshark graphical interface, choose an interface to capture from. If you want to start wireshark in application menu, you have to log out of the current session and log back in. Now start the wireshark program from the terminal: Archlinux: wireshark-gtk or wireshark-qt To temporily set wireshark as the user’s primary group, run the following command: newgrp wireshark

Wireshark will be the user’s secondary group. To run wireshark as normal user you have to add yourself into wireshark group. Note that when installing wireshark on elementray OS, there is no wireshark group, you have to run sudo dpkg-reconfigure wireshark-common command to create wireshark group and allow wireshark group members to be able to capture packets. You can verify this by looking at the end of /etc/group file. Next, it will ask you Should non-superusers be able to capture packets? Press the left arrow key on your keyboard to select and hit Enter.Įlementary OS sudo apt-get install wireshark Fedora sudo dnf install wireshark-gnome Start Capturing PacketĪ new group named wireshark will be created when installing wireshark. Or sudo pacman -S wireshark-qt Debian/Ubuntu sudo apt-get install wiresharkĭuring the installation process, it will let you know that by default non-root users are not allowed to capture packet. Installation Archlinux sudo pacman -S wireshark-gtk By default, only root can capture packets and I will explain how to let non-root users to be able to capture packets. In this tutorial, I’m going to show you how to install wireshark on Archlinux, Debian/Ubuntu, Fedora.

Wireshark download ubuntu 20.04