Install and Use Wireshark on Kali Linux (2026)

What is Wireshark?

Wireshark is the most widely-used network protocol analyzer in the world. It captures every packet flowing through a network interface and lets you dissect each one down to the bit level — source, destination, protocol, payload, timing. If your laptop is having weird WiFi issues, if you're investigating a security incident, if you want to know what your "smart" toaster is actually sending to the internet — Wireshark is the answer.

The current version as of 2026 is Wireshark 4.6.5. It's free, open source, and runs natively on Linux, macOS, and Windows. On Kali Linux it's pre-installed and ready to use — one of the top 10 Kali Linux tools every user should know.

How Wireshark Actually Works

At a high level, Wireshark does three things:

1. Captures raw packets from your network interface using libpcap (the same library tcpdump uses)
2. Dissects each packet using thousands of built-in protocol parsers — it understands over 3,000 protocols out of the box
3. Displays the dissected data in a structured, searchable, filterable interface

The dissection is the magic. A raw Ethernet frame is just bytes. Wireshark sees those bytes and says: "this is an Ethernet header, inside it is an IPv4 packet, inside that is a TCP segment, inside that is an HTTP POST request to /login with username=admin&password=hunter2." Suddenly bytes become information.

Installing & Setting Up Wireshark

Wireshark ships pre-installed on Kali Linux. If you need to install or update it:

If apt update errors out with a signing-key or repository problem here, see how to fix broken Kali updates before continuing.

Capturing without sudo (recommended)

By default, Wireshark requires root privileges to capture packets. Running the GUI as root is a security risk — Wireshark is a complex application with a long history of vulnerabilities in protocol dissectors. The proper fix is to add your user to the wireshark group:

Platform-specific notes

• Windows: Install Npcap when prompted — it's the capture driver. WinPcap is end-of-life; don't use it.
• macOS: Grant Wireshark "Network Monitoring" permission in System Settings → Privacy & Security. On Sequoia, you'll also need to grant Full Disk Access for some capture scenarios.
• Linux in a VM: Wireshark works fine on virtual interfaces (eth0 inside the VM). For monitor mode on wireless, you need USB passthrough of a compatible USB WiFi adapter — built-in laptop cards almost never work.

The Wireshark UI Tour

When you first open Wireshark, you see the Welcome screen — a list of available network interfaces with little sparkline graphs showing traffic activity. Pick the interface with traffic (usually eth0 for wired, wlan0 for WiFi) and double-click to start capturing.

Once capturing, the main window has three panes:

1. Packet list (top) — every captured packet, one per row. Shows number, time, source, destination, protocol, length, and a short summary. Click any packet to inspect it.
2. Packet details (middle) — the selected packet expanded into its protocol layers (Ethernet → IP → TCP → HTTP, for example). Click the triangles to drill into each layer.
3. Packet bytes (bottom) — the raw hex bytes of the packet. Clicking a field in the details pane highlights the corresponding bytes here.

Key interface elements

• Blue shark fin (top left) — start a new capture on the selected interface
• Red square — stop the current capture
• Green filter bar (top) — type display filters here (more on this below)
• Color coding — Wireshark colors packets by protocol/type. Light blue = TCP, light green = HTTP, black = TCP errors. You can customize colors in View → Coloring Rules.

Capture Filters vs. Display Filters

This is the #1 thing beginners get confused by, and Wireshark has two different filter syntaxes. Understanding the difference is critical.

For most pentesting work, you'll use display filters almost exclusively. Capture filters only matter when you're capturing on a busy network and risk losing packets or filling your disk. Start with no capture filter, then use display filters to focus.

The Essential Display Filters

Wireshark has over 328,000 filter fields across 3,000 protocols. You'll use about 20 of them. Memorize these:

By protocol

By IP address

By port

The pentester's favorites

Combining filters

Use and, or, and not (or their symbols &&, ||, !) to combine filters:

Real-World Examples

Now put this to use. Each example below is a workflow you'll hit in pentesting or troubleshooting.

Example 1: Sniff plaintext credentials

This is the classic Wireshark exercise — and a great way to convince yourself why HTTPS matters.

1. Start a Wireshark capture on your local interface
2. Visit a test login form over HTTP (use http://testphp.vulnweb.com/login.php for legal practice — it's a deliberately vulnerable site)
3. Submit any username and password
4. Stop the capture and apply this filter: http.request.method == "POST"
5. Click the POST request, expand the HTML Form URL Encoded section in the packet details

You'll see your username and password sitting there in plaintext. That's exactly what an attacker on the same network would see if you logged into an HTTP site from a coffee shop. Never log into anything over HTTP.

Example 2: Analyze a captured WPA2 handshake

If you've followed my WPA2 cracking tutorial, you've captured a 4-way handshake with airodump-ng. Before you crack it, open the .cap file in Wireshark to verify it's clean:

Apply the filter eapol to show only the 4-way handshake packets. You need to see all four EAPOL packets (Message 1 of 4 through Message 4 of 4) for a complete handshake. If you only see 2 or 3, the handshake is incomplete and won't crack — capture again and force another handshake with aireplay-ng.

Example 3: Investigate a slow website

Your client says "the website is slow." Open Wireshark, browse to the slow site, capture for 30 seconds, then:

1. Apply filter http to see HTTP requests
2. Right-click the first HTTP request → Follow → HTTP Stream to see the complete request/response
3. Check the time delta column — large gaps between request and response point to server-side slowness
4. Apply dns to check if DNS lookups are slow
5. Use Statistics → Conversations → TCP to see which connections took longest

Example 4: Detect a port scan

If someone is nmap-scanning your machine, Wireshark sees it immediately. Apply this filter:

If you see one source IP sending SYN packets to dozens of different destination ports in quick succession, that's a port scan. Right-click the source IP → Apply as Filter → Selected to see everything that attacker is doing.

Example 5: Find DNS exfiltration

Some malware exfiltrates data over DNS to bypass firewalls. Suspicious DNS patterns include very long subdomain names (often base64-encoded data) and unusually high DNS volume to one domain.

Following Streams

"Follow Stream" is one of Wireshark's most useful features. Instead of looking at packets one at a time, it reconstructs an entire conversation into a single readable view.

Right-click any packet and select Follow → TCP Stream (or HTTP Stream, or UDP Stream). You'll see the complete back-and-forth conversation — for HTTP, that means the full request and response with headers, cookies, form data, and HTML body all in one window.

The dialog also shows packet directions in different colors (client→server vs server→client), making it easy to spot what each side said.

The Statistics Menu (Underrated)

Most beginners ignore the Statistics menu, which is a mistake. It contains some of Wireshark's most powerful analysis tools:

• Statistics → Protocol Hierarchy — breakdown of what protocols are in your capture and what percentage each represents. Great for spotting anomalies (40% DNS by bytes is suspicious).
• Statistics → Conversations — every conversation between IP pairs, sorted by bytes/packets/duration. Find the "top talkers" instantly.
• Statistics → Endpoints — every IP/MAC address seen, with traffic totals. Useful for network discovery.
• Statistics → IO Graph — plot packet rate over time. Spot traffic spikes that correlate with reported problems.
• Statistics → DNS — full DNS query analysis
• Statistics → HTTP → Requests — every HTTP request, sortable

Tshark — Wireshark in the Terminal

Wireshark ships with tshark, a command-line version with all the same dissection power. It's essential for headless servers, scripting, and processing huge captures.

Tshark is also the easiest way to process huge captures — opening a 2GB pcap in Wireshark GUI takes forever, but tshark with a tight display filter can grep through it in seconds.

Capturing in Monitor Mode (WiFi)

By default, your WiFi card only captures traffic destined for your own machine. To capture all wireless traffic in range — including handshakes from other devices — you need monitor mode. This requires a compatible USB WiFi adapter (built-in laptop cards almost never work).

In monitor mode, you'll see 802.11 frames including beacons, probe requests, and association/authentication frames from every nearby device. Useful filters:

For the full WiFi pentesting workflow, see my WPA2 cracking tutorial — Wireshark is used there to verify captured handshakes before cracking.

Decrypting HTTPS Traffic

By default, you can't read HTTPS traffic in Wireshark — it's encrypted, that's the whole point. But there are two scenarios where decryption is possible:

Method 1: SSLKEYLOGFILE (modern, recommended)

Browsers like Chrome and Firefox can be configured to log TLS session keys to a file. Wireshark can then use those keys to decrypt the captured HTTPS.

Method 2: Server private key (legacy)

If you have the server's RSA private key, you can decrypt HTTPS traffic — but only for non-Perfect-Forward-Secrecy cipher suites. Modern TLS 1.3 uses ephemeral keys so this method rarely works anymore.

Saving & Sharing Captures

Wireshark saves captures in .pcap or .pcapng format. Both are widely compatible — tcpdump reads .pcap, modern Wireshark prefers .pcapng (supports comments, more metadata).

Performance Tips for Large Captures

Wireshark struggles with multi-gigabyte captures because it loads everything into RAM. Strategies for handling big captures:

• Use capture filters to reduce file size at capture time (e.g., port 80 or port 443 to capture only web traffic)
• Use ring buffer mode — Capture → Options → Output → "Create a new file automatically after X megabytes" — to split captures into manageable chunks
• Process with tshark first — use tshark -r big.pcap -Y "interesting filter" -w smaller.pcap to extract the relevant subset, then open the smaller file in GUI
• Set snapshot length — tshark -i eth0 -s 128 captures only the first 128 bytes of each packet, enough for headers, dramatically reducing file size

Defender vs. Attacker Perspectives

Wireshark is dual-use — same tool, different goals.

From the attacker's side

• Credential harvesting on unencrypted protocols (HTTP, FTP, Telnet, POP3)
• Confirming exploit success — did the reverse shell connect back?
• Mapping the network — passive discovery of hosts, services, OS fingerprints via traffic patterns
• Captured WiFi handshake analysis before sending to hashcat
• Detecting countermeasures — IDS reset packets, WAF blocks, rate limiting

From the defender's side

• Incident response — what did the attacker actually do? Did data leave the network?
• Detecting port scans (the tcp.flags.syn == 1 and tcp.flags.ack == 0 filter)
• Spotting C2 traffic — beaconing patterns, DNS exfiltration, unusual outbound connections
• Verifying encryption — is the corporate VPN actually encrypting? Is that "secure" IoT device actually using HTTPS?
• Troubleshooting — why is this app slow, why won't this server respond, why does the firewall keep killing this connection

Common Issues & Troubleshooting

"No interfaces found" or empty interface list

You either don't have permission to capture or your capture driver isn't installed. On Linux, run sudo dpkg-reconfigure wireshark-common and select Yes to allow non-root capture, then re-add yourself to the wireshark group. On Windows, install or reinstall Npcap. On macOS, grant Network Monitoring permission in System Settings.

"Can't see traffic from other devices on my network"

Modern switched networks isolate traffic — your switch only sends each port the traffic destined for that port. To see other devices' traffic you need either:

• A managed switch with port mirroring (SPAN) configured
• A network tap (hardware device that splits traffic)
• ARP spoofing tools like ettercap (only on networks you own)
• Monitor mode on WiFi (captures everything in the air, not just for you)

"Wireshark says I can capture but no packets appear"

You're probably on the wrong interface. Look at the little sparklines next to interface names on the welcome screen — the one with traffic is the right one. If your laptop has multiple interfaces (eth0, wlan0, docker0, lo), make sure you're on the one actually connected to the internet.

"Wireshark crashes on large captures"

Wireshark loads the whole capture into RAM. For files over 1GB, use tshark with a display filter to extract the subset you need, or split the file with editcap -c 100000 big.pcap split_ (splits into chunks of 100,000 packets each).

"Display filter is red / won't apply"

Syntax error. Common causes: using = instead of ==, using single quotes instead of double quotes, mistyped field names. Wireshark turns the filter bar red when the syntax is invalid and green when it's valid. Start typing and watch for the color change.