How to Install Wireshark on Ubuntu

Wireshark is the standard open-source tool for capturing and decoding network packets—troubleshooting DNS, HTTP, VPN issues, or learning how protocols behave on the wire. On Ubuntu it lives in the universe repository as the wireshark package (GUI) and optional tshark (CLI).

This guide shows how to install Wireshark on Ubuntu, fix the common “no interfaces” / permission denied errors after install, and run a first capture. I ran the steps on Ubuntu 25.04 with real terminal output below.

Tested on: Ubuntu 25.04 (Plucky Puffin); kernel 6.14.0-37-generic; amd64; Wireshark 4.4.5.

Prerequisites

• Ubuntu 22.04 LTS, 24.04 LTS, or newer (25.04 tested)—see check Ubuntu version.
• sudo for package install and group changes.
• universe enabled (sudo add-apt-repository universe on minimal images).
• A user account you will add to the wireshark group for non-root capture.

Choose an install method

Wireshark’s official documentation describes Debian/Ubuntu .deb installs the same way: use your distribution packages when they are current enough.

Method 1: Install Wireshark from Ubuntu repositories (recommended)

Update indexes and install the GUI metapackage:

sudo apt update
sudo apt install -y wireshark

On Ubuntu 25.04 the install pulled Wireshark 4.4.5 and dependencies; near the end:

Setting up libwireshark18:amd64 (4.4.5-1) ...
Setting up wireshark-common (4.4.5-1) ...
Setting up wireshark (4.4.5-1) ...
Processing triggers for man-db (2.13.0-1) ...

Confirm version and packages:

wireshark --version
dpkg -l wireshark wireshark-common | grep '^ii'

Wireshark 4.4.5.

ii  wireshark         4.4.5-1  amd64  network traffic analyzer - graphical interface
ii  wireshark-common  4.4.5-1  amd64  network traffic analyzer - common files

Allow non-root packet capture

The installer asks whether non-superusers may capture packets. Choose Yes so members of the wireshark group can run captures without sudo wireshark every time (Ask Ubuntu, Microchip Wireshark setup notes).

Interactive reconfigure anytime:

sudo dpkg-reconfigure wireshark-common

For non-interactive installs (scripts, cloud images):

echo 'wireshark-common wireshark-common/install-setuid boolean true' | sudo debconf-set-selections
sudo apt install -y wireshark

After Yes, dumpcap gets network capture capabilities:

getcap /usr/bin/dumpcap
ls -l /usr/bin/dumpcap

/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip
-rwxr-x--- 1 root wireshark ... /usr/bin/dumpcap

You do not need sudo chmod +x /usr/bin/dumpcap—that was misleading advice in older tutorials. Permissions are handled by capabilities and the wireshark group.

Add your user to the wireshark group

sudo usermod -aG wireshark $USER

Verify:

getent group wireshark

wireshark:x:131:yourusername

Log out and log back in (or reboot) so the new group membership applies. Until then, dumpcap may return Permission denied even after install—that caught me in the same shell session until I used sg wireshark.

Optional: some USB or serial adapters also need dialout:

sudo usermod -aG dialout $USER

List capture interfaces

After a fresh login (or sg wireshark for a quick test):

dumpcap -D

1. enp0s3
2. enp0s8
3. any
4. lo (Loopback)
5. docker0
...

Launch the GUI:

wireshark

Or open Activities → Wireshark, pick an interface (for example enp0s3), and click the blue shark fin to start capture. Stop with the red square button.

Method 2: wireshark-dev PPA (optional)

Some guides (GeeksforGeeks) add ppa:wireshark-dev/stable when universe is older than you need. On Ubuntu 25.04, universe already ships 4.4.5—skip the PPA unless you have a specific upstream feature requirement.

sudo add-apt-repository -y ppa:wireshark-dev/stable
sudo apt update
sudo apt install -y wireshark

Then repeat the capture permission steps (dpkg-reconfigure wireshark-common, wireshark group, new login session).

Remove the PPA if you no longer need it:

sudo add-apt-repository --remove -y ppa:wireshark-dev/stable
sudo apt update

Method 3: Install tshark (CLI only)

On servers without a desktop, install the command-line tool:

sudo apt install -y tshark

Setting up tshark (4.4.5-1) ...

tshark --version

TShark (Wireshark) 4.4.5.

List interfaces (same group rules as the GUI):

sg wireshark -c 'tshark -D'

1. enp0s3
2. enp0s8
3. any
4. lo (Loopback)

Example capture (5 packets on enp0s3—adjust interface name):

sudo tshark -i enp0s3 -c 5

Use sudo only if you have not finished group setup; after wireshark group + new session, capture without root is preferred.

Update Wireshark

sudo apt update
sudo apt install --only-upgrade wireshark wireshark-common tshark
wireshark --version

Uninstall Wireshark

sudo apt purge -y wireshark wireshark-common tshark
sudo apt autoremove -y

See remove unused packages on Ubuntu for reviewing what autoremove proposes and cleaning leftover apt cache or rc configs.

Troubleshooting

Next steps

• Wireshark IP filters cheat sheet
• How to use Wireshark
• Wireshark tutorial

References

• Wireshark — Building and installing
• Installing from debs on Debian/Ubuntu — Wireshark User Guide
• Wireshark download
• Ask Ubuntu — How to install Wireshark

Summary

Install Wireshark on Ubuntu with sudo apt install wireshark from universe, allow non-superusers to capture during wireshark-common setup, and add your account to the wireshark group before you expect live capture to work. On Ubuntu 25.04 that gives Wireshark 4.4.5 with dumpcap capabilities—no PPA required for most users.

Use tshark on headless systems, log out after usermod, and capture only on networks you are allowed to monitor. When something fails, check getcap /usr/bin/dumpcap and dumpcap -D in a session where the wireshark group is active—not chmod on dumpcap.