Wireshark

Wireshark is a network packet analyzer that evolved from the program Ethereal, a project initiated in 1997 by Gerald Combs. It is the goto tool to troubleshoot network problems, examining security problems, verifying network applications and debug protocol implementations. Wireshark can capture packets going through all network interfaces of the machine it is installed on.
Wireshark comes with two applications: the GUI app Wireshark and the CLI app tshark.

setup

Wireshark captures packets not by reading a standard file on your disk, but via underlying OS mechanisms, i.e. libpcap, BPF devices on macOS/BSD, or raw sockets/capabilities on Linux. Normal users shouldn’t be granted access to kernel-level networking capabilities.

Granting full root access to the Wireshark app would cause security risks because network protocols are notoriously complex to parse and this can expose bugs. Thus, Wireshark works with privilege separation and splits its tasks. The GUI handles safe tasks (dissection, display), while a binary called dumpcap performs the packet capturing.

installation

Wireshark packages are available on almost every Linux distro. If a binary package is not available for your distro you can download the source from wireshark.org/download and try to build it (I never had to).

set network privileges for dumpcap

This works if your kernel and file system support file capabilities. As root, run:

Note: check the path for dumpcap, it might be on a different path on your machine, i.e. /usr/bin/dumpcap

limit capture permission to group wireshark

• create the group wireshark (if you installed wireshark by your distro’s packet manager, that group might already have been created during the installation of wireshark): groupadd --system wireshark
• add Wireshark users to that group: usermod -a -G wireshark <user>.
• change ownership and permissions of the dumpcap binary: chown root:wireshark /usr/sbin/dumpcap and chmod 750 /usr/sbin/dumpcap