Install and run Wireshark on the command line (CentOS 5.2)

6 August, 2008 at 10:00 pm by Phil Wiffen · Filed under Linux, Security

Using CentOS 5.2 or Red Hat Enterprise Linux 5, install and run Wireshark (formerly Ethereal) over the command line.

Install Wireshark:

yum install wireshark

Run a capture:

tethereal -i eth1 -w ~/mycapture.pcap

This command will run Wireshark/Ethereal, capture on the eth1 interface and output the data to /yourhomedir/mycapture.pcap

Why would you want to do this? If you want to capture packets from a headless or remote Linux PC and analyse the data elsewhere.

Right now I’m at home, but I have a headless CentOS box at work that’s running ntop from a mirrored port, in order to look at network traffic flowing over the router. To increase the capability of the CentOS box, I want to use it to capture packets using Wireshark, then download the .pcap file over WinSCP and look at the data on my laptop using Wireshark for Windows.

Related posts

2 Comments »

  1. mohamed said,

    8 April, 2009 at 12:00 pm

    i want to ask how can i open GUI of wireshark in linux?

    thanks

    regards,

  2. Michael said,

    10 September, 2009 at 4:03 pm

    To install a wireshark GUI type:

    yum install wireshark-gnome

    let it install, then find wireshark in Applications->Internet of Linux.

    Do remember that to install Wireshark first day you initially need to go:

    yum install wireshark

    -M

RSS feed for comments on this post · TrackBack URL

Leave a Comment