How To Install Wireshark on Debian 11/10/9 Desktop

Posted on 312 views

How can I install Wireshark on Debian 11/10/9?. Wireshark is an open-source network analysis and packet capture tool commonly used in the world of Network Engineers. Wireshark is a cross-platform application and it runs on Linux, Windows, and macOS. You can operate it from a GUI or CLI – Your comfort area is the limit!.

On Ubuntu, check: How to install Wireshark on Ubuntu Desktop

Features of Wireshark

Wireshark comes with a rich set of features like:

  • Deep inspection of hundreds of protocols, with more being added all the time
  • Live capture and offline analysis
  • Standard three-pane packet browser
  • Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others
  • Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
  • The most powerful display filters in the industry
  • Rich VoIP analysis
  • Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
  • Capture files compressed with gzip can be decompressed on the fly
  • Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
  • Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
  • Coloring rules can be applied to the packet list for quick, intuitive analysis
  • Output can be exported to XML, PostScript®, CSV, or plain textInsta

Install Wireshark on Debian 11/10/9

The quickest installation is from Debian repositories.

sudo apt update
sudo apt install wireshark

When asked whether to allow non-superusers to capture packets, select your option and finish the installation.


Confirm the version of Wireshark installed on Debian 10 / Debian 9 Desktop.

$ apt policy wireshark
  Installed: 3.4.10-0+deb11u1
  Candidate: 3.4.10-0+deb11u1
  Version table:
 *** 3.4.10-0+deb11u1 500
        500 bullseye/main amd64 Packages
        500 bullseye-security/main amd64 Packages
        100 /var/lib/dpkg/status

Configure and start Wireshark

To be able to capture packets as a normal user, add your user to wireshark group.

sudo usermod -a -G wireshark $USER

Also change dumpcap binary file permissions.

sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap


$ sudo getcap /usr/bin/dumpcap
 /usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip

Starting Wireshark on Debian 10 / Debian 9

You can launch Wireshark on Debian 10 / Debian 9 from the terminal or Applications launcher.


The same can be done from the command line by typing:

$ wireshark

Enjoy using Wireshark on Debian 10 (Buster) / Debian 9.


Gravatar Image
A systems engineer with excellent skills in systems administration, cloud computing, systems deployment, virtualization, containers, and a certified ethical hacker.