How To Install Wireshark on Ubuntu 26.04 LTS

Wireshark is one of those tools that earns its place on almost every Linux administrator’s workstation. It can reveal why an application is slow, whether a service is actually listening on the expected port, why TLS handshakes fail, or whether a server is quietly dropping packets under load. On Ubuntu 26.04 LTS, installing it is straightforward, but configuring it safely for regular use requires a little more thought.

The usual instinct is to run sudo wireshark and start capturing. That works, but it is not a good long-term habit. Running the entire GUI as root gives the application far more privilege than it needs. A better setup lets your normal desktop user capture traffic through the carefully privileged dumpcap helper while keeping Wireshark itself unprivileged. This approach reduces risk, especially on systems that also handle browsing, development work, or administrative SSH sessions.

Ubuntu 26.04 LTS ships Wireshark through its repositories, so the cleanest installation path is APT. The distribution package includes the graphical interface and the packet-capture components needed for live analysis. For servers or minimal installations, you can install only the command-line tools and avoid pulling in the desktop GUI. [9][11][13]

This guide covers the full workflow: preparing the system, installing Wireshark, enabling non-root packet capture, verifying the installation, capturing traffic, using display and capture filters, troubleshooting permission problems, and applying production-safe practices. The commands are written for Ubuntu 26.04 LTS, but most of the approach also applies to recent Debian and Ubuntu derivatives.

Before You Install Wireshark

Wireshark is a network protocol analyzer. It captures packets from a network interface, decodes them into readable protocol layers, and lets you inspect details such as TCP handshakes, DNS queries, HTTP requests, TLS certificate information, DHCP exchanges, and malformed frames.

That capability is powerful. It is also sensitive.

A packet capture can expose usernames, session tokens, API keys, internal hostnames, database queries, and other confidential data. Treat capture files as operational evidence, not casual downloads. On a production system, a poorly scoped capture can fill a disk quickly or create an unnecessary security exposure.

What You Need

Before starting, confirm that you have:

An Ubuntu 26.04 LTS system with sudo access
A working internet connection for package installation
A desktop environment if you intend to use the Wireshark GUI
Basic familiarity with the terminal
Permission to capture traffic on the target network, where applicable

You do not necessarily need a GUI. On a headless server, tshark and dumpcap are often more appropriate than the full Wireshark desktop application.

Check Your Ubuntu Version

First, make sure you are actually running Ubuntu 26.04:

lsb_release -a

Expected output should include something similar to:

Distributor ID: Ubuntu
Description:    Ubuntu 26.04 LTS
Release:        26.04
Codename:       resolute

You can also verify the kernel and architecture:

uname -a
dpkg --print-architecture

Most modern Ubuntu installations use amd64, though ARM64 systems are increasingly common on cloud instances, Raspberry Pi-class hardware, and ARM servers.

Update the System

Before installing new software, refresh APT’s package metadata. This ensures that Ubuntu knows about the latest available package versions and dependency information.

sudo apt update

If you want to bring the system up to date at the same time, run:

sudo apt upgrade -y

On a production server, do not blindly upgrade every package during a maintenance window without checking release notes, planned restarts, and service dependencies. A kernel, OpenSSL, glibc, or networking-related update can require a reboot or interrupt a running workload.

For a workstation or lab machine, updating first is usually the sensible default.

Install Wireshark from Ubuntu Repositories

Ubuntu’s official repositories are the preferred installation method for most users. The package is maintained for the distribution, receives security updates through the normal Ubuntu update process, and avoids the dependency headaches that can come with manually downloaded packages.

Install the Full Wireshark GUI

To install Wireshark with its graphical interface:

sudo apt install wireshark -y

APT resolves and installs the required dependencies, including the capture engine and supporting libraries. Ubuntu 26.04 provides Wireshark in the Universe repository; the available package version may differ slightly depending on when you run the installation and which repository mirrors your system uses. [9][11][13]

After installation, confirm the installed version:

wireshark --version

You should see output similar to this:

Wireshark 4.6.4 ...

The exact build information can vary, but the command should return cleanly rather than reporting “command not found.”

Install Command-Line Tools Only

On a server, VPS, container host, or minimal desktop installation, the GUI is often unnecessary. Install tshark instead:

sudo apt install tshark -y

tshark is Wireshark’s terminal-based counterpart. It uses much of the same protocol-dissection logic but presents output in the terminal. It is ideal for SSH sessions, automated diagnostics, scripted captures, and remote troubleshooting.

You can also install dumpcap directly if your use case is strictly packet capture:

sudo apt install dumpcap -y

dumpcap is the low-level capture utility used by Wireshark and TShark. It writes raw packet data to a capture file, usually in pcap or pcapng format. [3][6]

Verify the Installation

Check that the main binaries are available:

which wireshark
which tshark
which dumpcap

Then check their versions:

wireshark --version
tshark --version
dumpcap --version

A quick way to confirm that the capture engine can see interfaces is:

dumpcap -D

You should see a numbered list similar to this:

1. enp3s0 [Up, Running, Connected]
2. lo [Up, Running, Loopback]
3. any [Up, Running, Pseudo-device that captures on all interfaces]
4. docker0 [Up]

Interface names vary. Ubuntu commonly uses predictable names such as enp3s0, ens18, enp0s3, or wlp2s0, depending on hardware and virtualization.

Configure Non-Root Packet Capture

This is the part that separates a quick test installation from a properly configured workstation.

By default, a non-root user cannot capture packets directly from network interfaces. Linux restricts access to raw sockets and low-level networking capabilities because unrestricted packet capture can expose traffic from other users and services.

Wireshark handles this through dumpcap. The GUI and TShark delegate the privileged capture operation to dumpcap, which can be granted only the capabilities required to capture packets.

Choose the Installation Prompt Carefully

During installation, Ubuntu may ask whether non-superusers should be allowed to capture packets.

If you select Yes, the package configures the wireshark group and grants the necessary capture capability to dumpcap. You still need to add your user account to that group.

If you select No, only root can capture packets initially. That is the more conservative default, but it becomes inconvenient if you regularly use Wireshark.

For a personal workstation used by a trusted administrator, selecting Yes is reasonable. On a multi-user system, be more cautious and restrict membership in the wireshark group.

Add Your User to the Wireshark Group

First, verify whether the group exists:

getent group wireshark

If it exists, add your current user:

sudo usermod -aG wireshark $USER

Alternatively, use gpasswd:

sudo gpasswd -a $USER wireshark

Then verify group membership:

groups

You may see:

youruser adm cdrom sudo dip plugdev wireshark

Group membership does not take effect in an already-open terminal or desktop session. Log out and log back in, or start a new login session.

A quick test:

newgrp wireshark
groups

The Wireshark project documents this group-based approach for Debian and Ubuntu systems, including the need to re-login so the new group membership applies. [4]

Check dumpcap Permissions

The exact location of dumpcap can vary by package and release. Check it first:

command -v dumpcap

On many Ubuntu systems, it is located at:

/usr/bin/dumpcap

Inspect its ownership and permissions:

ls -l "$(command -v dumpcap)"
getcap "$(command -v dumpcap)"

A properly configured installation should show the wireshark group associated with the binary and capabilities such as cap_net_admin and cap_net_raw. These capabilities allow dumpcap to capture traffic without giving the entire Wireshark application root privileges. [1][5]

If you need to repair permissions manually, use a narrowly scoped approach:

sudo chgrp wireshark "$(command -v dumpcap)"
sudo chmod 750 "$(command -v dumpcap)"
sudo setcap cap_net_raw,cap_net_admin=eip "$(command -v dumpcap)"

Be careful with these commands. Changing the group or permissions can clear file capabilities, so reapply setcap afterward if needed. The Wireshark documentation specifically warns that changing ownership or permissions may require resetting capabilities. [4][5]

Test Capture Permissions

Run a very short capture as your normal user:

dumpcap -D

Then attempt a five-second capture on your primary interface. Replace enp3s0 with the interface name shown by dumpcap -D or ip -br link:

dumpcap -i enp3s0 -w /tmp/test-capture.pcap -a duration:5

If it completes without a permissions error, your non-root capture setup is working.

You can open that file in the GUI:

wireshark /tmp/test-capture.pcap

Or inspect it from the terminal:

tshark -r /tmp/test-capture.pcap

Launch Wireshark

On an Ubuntu desktop, launch Wireshark from the application menu or run:

wireshark

You can also start a live capture directly from the command line:

wireshark -i enp3s0 -k

The -i option selects the interface, while -k starts capture immediately. This is useful when you already know which interface you need to inspect. The Wireshark user guide documents both options. [7]

For a remote server, avoid running the GUI over SSH unless you have a reliable X11 or Wayland forwarding setup. In most real-world cases, capture with dumpcap or tshark on the server, then copy the resulting file to your workstation for analysis.

Example:

dumpcap -i ens18 -w /tmp/web-issue.pcap -a duration:60
scp user@server:/tmp/web-issue.pcap .
wireshark web-issue.pcap

That workflow keeps the GUI local while preserving the server-side capture.

Identify the Right Network Interface

Choosing the wrong interface is one of the most common reasons a capture appears empty. On a machine with physical Ethernet, Wi-Fi, VPN tunnels, Docker bridges, and virtual interfaces, traffic may be flowing through an interface other than the one you selected.

List interfaces with IP addressing:

ip -br addr

Example output:

lo               UNKNOWN        127.0.0.1/8 ::1/128
enp3s0           UP             192.168.1.50/24
wlp2s0           DOWN
docker0          UP             172.17.0.1/16
wg0              UP             10.8.0.2/24

In this example, enp3s0 is the primary LAN interface. If you are diagnosing Docker networking, docker0 may be relevant. If traffic travels through a WireGuard tunnel, inspect wg0 as well.

You can also use:

ip link show

Or ask dumpcap directly:

dumpcap -D

For a first capture, the any pseudo-interface can be useful because it captures traffic across all interfaces. It is convenient for broad troubleshooting, but it can generate large files quickly on a busy system.

Capture Traffic Safely

A capture without limits is a common operational mistake. On a busy production server, unrestricted packet capture can consume disk space at an alarming rate. A 10 Gbps interface under sustained load can generate enormous capture files in minutes.

Use capture limits from the start.

Capture for a Fixed Duration

Capture for 30 seconds:

dumpcap -i enp3s0 -w /tmp/capture-30s.pcap -a duration:30

For 60 seconds:

dumpcap -i enp3s0 -w /tmp/capture-60s.pcap -a duration:60

This is usually the right approach when reproducing an intermittent issue. Start the capture, reproduce the problem, then stop automatically.

Limit File Size

Capture until the file reaches 100 MB:

dumpcap -i enp3s0 -w /tmp/capture-100mb.pcap -a filesize:100000

The filesize value is in kilobytes. This limit helps prevent a runaway capture from filling a filesystem.

Use a Ring Buffer

For longer diagnostic windows, use multiple files with a ring buffer:

dumpcap -i enp3s0 -w /tmp/capture.pcap -b files:10 -b filesize:50000

This keeps up to 10 files of approximately 50 MB each. Once the limit is reached, older files are overwritten. It is a practical pattern for catching an intermittent event without retaining hours of irrelevant traffic.

Capture Only the Traffic You Need

Use a capture filter before packets reach the analysis layer. Capture filters use BPF syntax and reduce CPU, memory, and disk usage.

Capture traffic to or from one host:

dumpcap -i enp3s0 -w /tmp/host-capture.pcap host 203.0.113.10

Capture only HTTP traffic:

dumpcap -i enp3s0 -w /tmp/http-capture.pcap tcp port 80

Capture DNS traffic:

dumpcap -i enp3s0 -w /tmp/dns-capture.pcap udp port 53

Capture traffic between two hosts:

dumpcap -i enp3s0 -w /tmp/two-hosts.pcap host 192.168.1.20 and host 192.168.1.30

Capture only TCP traffic on a web server:

dumpcap -i enp3s0 -w /tmp/web.pcap 'tcp port 80 or tcp port 443'

A focused capture is easier to analyze, smaller to store, and safer to share with a colleague or vendor.

Use Wireshark Display Filters

Display filters do not reduce what was captured. They control what Wireshark shows after capture. That distinction matters: a capture filter conserves resources, while a display filter helps you find the relevant packets in an existing file.

Useful display filters include:

http

Shows HTTP traffic.

dns

Shows DNS queries and responses.

tcp.port == 443

Shows TCP traffic on port 443.

ip.addr == 192.168.1.50

Shows packets involving a specific IP address.

ip.src == 192.168.1.50 && tcp.flags.syn == 1 && tcp.flags.ack == 0

Shows TCP SYN packets originating from a host, useful for connection-attempt analysis.

tcp.analysis.retransmission

Highlights TCP retransmissions, which can indicate packet loss, congestion, or an unstable path.

tcp.analysis.duplicate_ack

Shows duplicate acknowledgements, often associated with loss or delayed segments.

tls.handshake.type == 1

Shows TLS Client Hello messages.

http.request.method == "GET"

Shows HTTP GET requests, assuming the traffic is not encrypted.

icmp

Shows ICMP traffic, including ping requests, replies, and error messages.

When troubleshooting a slow application, start with the TCP conversation, then look for retransmissions, zero-window events, resets, and long gaps between requests. Protocol-level symptoms often point to an application or infrastructure issue rather than the network itself.

Troubleshooting Common Installation Issues

“Permission Denied” When Capturing

This is the most frequent Wireshark issue on Ubuntu.

Typical symptoms include:

You don't have permission to capture on that device

Or:

dumpcap: Permission denied

First, confirm group membership:

groups

If wireshark is missing, add it:

sudo usermod -aG wireshark $USER

Then log out and back in. Group changes do not reliably apply to existing sessions.

Next, inspect the binary:

ls -l "$(command -v dumpcap)"
getcap "$(command -v dumpcap)"

If capabilities are missing, reapply them:

sudo setcap cap_net_raw,cap_net_admin=eip "$(command -v dumpcap)"

Finally, test again:

dumpcap -D
dumpcap -i enp3s0 -w /tmp/test.pcap -a duration:5

Wireshark Opens but Shows No Interfaces

If the interface list is empty, dumpcap may not be able to enumerate devices with your current privileges.

Run:

dumpcap -D

If that fails, check whether AppArmor, SELinux, or a hardened security policy is interfering. Ubuntu primarily uses AppArmor, though most standard Wireshark installations work without additional configuration.

Also verify that the user is in the wireshark group and that the binary has the expected capabilities.

No Packets Appear in the Capture

An empty capture usually means one of the following:

You selected the wrong interface
The interface has no traffic
The traffic is on another interface, such as a VPN or Docker bridge
A capture filter is too restrictive
The interface is administratively down
The traffic is being offloaded or handled elsewhere

Check interface status:

ip -br link
ip -br addr

Generate known traffic while capturing:

ping -c 4 1.1.1.1
curl -I https://example.com

If you still see nothing, try the any interface:

dumpcap -i any -w /tmp/all-interfaces.pcap -a duration:10

If that works, narrow down the correct interface.

Wireshark Fails to Start on a Headless Server

The GUI requires a display environment. On a server accessed through SSH, running wireshark without X11 or Wayland forwarding will fail.

Use TShark instead:

tshark -i enp3s0 -c 100

This captures 100 packets and prints a summary to the terminal.

For a file-based capture:

dumpcap -i enp3s0 -w /tmp/capture.pcap -a duration:30

Then analyze it later:

tshark -r /tmp/capture.pcap

APT Reports Unmet Dependencies

Dependency problems are uncommon with the official Ubuntu repository, but they can occur after partial upgrades, third-party repositories, or interrupted installations.

Try:

sudo apt update
sudo apt --fix-broken install

Then reinstall:

sudo apt install --reinstall wireshark

Avoid mixing random PPAs, third-party .deb files, and distribution packages unless you understand the version conflicts involved. On Ubuntu 26.04, the repository package is generally the least complicated and most maintainable option. [9][13]