Packet captures are one of the fastest ways to tell whether a problem lives in the network, the firewall, or the application itself. To install Wireshark on Ubuntu, the cleanest path is Ubuntu’s own APT package, while the Wireshark developers PPA only matters on the releases where Ubuntu ships an older branch. The package installs from the terminal on desktop and server images, but the Wireshark GUI still needs an active graphical session.
If you are looking for a Wireshark download on Ubuntu, use APT instead of hunting for a standalone Ubuntu installer. The Wireshark download page points Ubuntu users to the Launchpad PPA, while Ubuntu 26.04 (Resolute Raccoon) already ships Wireshark 4.6.x in Universe. Ubuntu 24.04 (Noble Numbat) ships 4.2.x, and Ubuntu 22.04 (Jammy Jellyfish) stays on 3.6.x, so the PPA is most useful on Ubuntu 24.04 and 22.04 when you want the newer 4.6.x branch.
Install Wireshark on Ubuntu
Start with a package metadata refresh so APT sees the current Universe package and any newer PPA candidate you decide to use.
sudo apt updateThese commands use
sudofor system-wide package management. If your account does not have sudo access yet, follow the guide on how to add a new user to sudoers on Ubuntu or run the commands from an account that already has administrative rights.
Wireshark comes from Ubuntu’s Universe component. Standard desktop installs usually have Universe enabled already, but if apt cannot find the package, enable Universe and Multiverse on Ubuntu first. Only Universe is required for Wireshark, but the linked guide also explains Ubuntu’s other optional repository components.
These two methods cover Ubuntu 26.04, 24.04, and 22.04. The default package is the best fit on Ubuntu 26.04, while the PPA upgrades Ubuntu 24.04 and 22.04 to a newer 4.6.x branch.
| Method | Source | Updates | Best Fit |
|---|---|---|---|
| APT (Default) | Ubuntu Universe | Automatic via apt upgrade | The simplest supported path, especially on Ubuntu 26.04 |
| Wireshark PPA | Launchpad PPA | Automatic via apt upgrade | Ubuntu 24.04 and 22.04 users who want the newer 4.6.x branch |
Keep the default repository on Ubuntu 26.04. Resolute already ships Wireshark 4.6.4, while the current PPA build for 26.04 is 4.6.3. On Ubuntu 24.04 and 22.04, the same PPA upgrades Wireshark to 4.6.4.
Most readers should stay with Ubuntu’s own package. Switch to the PPA only when the newer 4.6.x branch matters more than sticking with Ubuntu’s default build.
Wireshark is not currently available as a Snap package on Ubuntu; snap info wireshark returns no matching snap. If you searched for a Snap install command, use the APT package or the Wireshark developers PPA instead.
Ubuntu 20.04 is past standard LTS support, so the current examples focus on Ubuntu 26.04, 24.04, and 22.04. If you still maintain a 20.04 system through extended support, expect older Wireshark package branches and plan an Ubuntu upgrade before copying current-version output examples.
Method 1: Install Wireshark from the Ubuntu Repository
This is the default path on Ubuntu 26.04, 24.04, and 22.04, and it is the right choice on Ubuntu 26.04 because the distro package is already current.
sudo apt install wireshark -yThe -y flag confirms APT’s install prompt automatically. If you also want terminal-only captures, install tshark separately; on current Ubuntu LTS releases, apt install wireshark does not pull in the standalone tshark package.
Optional: Install TShark for Terminal Captures
Install tshark explicitly when you need terminal-only captures on a server, over SSH, or in scripts. Run this after choosing the default repository or PPA path so TShark comes from the same package source as Wireshark.
sudo apt install tshark -yThe tshark package uses wireshark-common too, so the same non-root capture prompt and wireshark group setup can apply even when you skip the graphical application.
Method 2: Install Wireshark from the Developers PPA
Use the developers PPA on Ubuntu 24.04 or 22.04 when you want Wireshark 4.6.x instead of the older Ubuntu package. Skip this method on Ubuntu 26.04, because Resolute already ships Wireshark 4.6.4 and the current PPA build trails it slightly.
Standard Ubuntu desktops already include add-apt-repository, but minimal images may need the helper package first.
If add-apt-repository is missing, install software-properties-common before you continue.
sudo apt install software-properties-common -yOnce the helper exists, add the Wireshark developers PPA.
sudo add-apt-repository ppa:wireshark-dev/stable -yRefresh APT and confirm that the PPA candidate is higher than Ubuntu’s own package before you install it.
sudo apt update && apt-cache policy wiresharkRelevant output on Ubuntu 24.04 includes the higher candidate below. The full version table should also list the PPA URL above Ubuntu’s own noble/universe package.
wireshark: Installed: (none) Candidate: 4.6.4-1~ubuntu24.04.0~ppa1
Install the PPA build once the candidate looks correct.
sudo apt install wireshark -yConfigure Non-Root Packet Capture for Wireshark on Ubuntu
During installation, Ubuntu asks whether non-superusers should be able to capture packets. That choice controls the permissions on dumpcap, the helper Wireshark uses for packet capture.
If you selected No during installation, or if you want to revisit the setting later, rerun the package configuration dialog.
sudo dpkg-reconfigure wireshark-commonSelect Yes in the dialog, then append your account to the wireshark group.
sudo usermod -aG wireshark $USERThe -aG flags append the wireshark group to your existing supplementary groups. Do not drop the -a flag, because usermod -G by itself replaces your current group list. The $USER variable expands to your current login name automatically.
Log out and back in to refresh every desktop process, or open a new shell with the updated group immediately.
newgrp wiresharkAfter re-logging or running newgrp, confirm that your account can actually see the capture group. The final filter uses the grep command in Linux to keep the output to the single group name.
id -nG "$USER" | tr ' ' '\n' | grep -Fx wiresharkwireshark
Next, confirm that dumpcap still has the packet-capture capabilities required for non-root use.
getcap /usr/bin/dumpcap/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip
Verify the Wireshark Installation on Ubuntu
Once the package and permissions are in place, confirm the installed Wireshark version.
wireshark --versionRelevant output on Ubuntu 26.04 includes:
Wireshark 4.6.4.
Ubuntu 24.04 prints Wireshark 4.2.2 from the default repository or 4.6.4 from the PPA. Ubuntu 22.04 prints 3.6.2 from the default repository or 4.6.4 from the PPA.
Launch Wireshark on Ubuntu
Launch the GUI only from a desktop session. If you are working on a headless Ubuntu host or over plain SSH, install tshark instead of trying to start the Wireshark interface without a display server.
Launch Wireshark from the Terminal
If you are already in a desktop terminal, start Wireshark directly. The wireshark command opens the graphical interface, while tshark is the separate terminal capture tool.
wiresharkAn empty interface list usually means the wireshark group or the dumpcap capabilities still need attention.
Launch Wireshark from the Application Menu
For desktop users, open Activities, search for Wireshark, and launch it from the application menu. You can pin it to the dock or favorites once the icon appears.
Update or Remove Wireshark on Ubuntu
APT handles both the default package and the PPA build, so update and package-removal steps share the same base commands. PPA source cleanup stays separate because it only applies to systems where you added the developers PPA.
Update Wireshark on Ubuntu
Refresh package metadata and upgrade the installed Wireshark packages when you want the latest build from your current source without running a full distribution upgrade. APT skips tshark if you did not install it earlier because --only-upgrade does not add new packages.
sudo apt update && sudo apt install --only-upgrade wireshark wireshark-common tsharkRemove Wireshark on Ubuntu
If you want to keep Wireshark installed but revoke your account’s capture access, remove your user from the wireshark group and then log out and back in. The guarded command below only runs gpasswd when the group exists and your account is listed in it.
if getent group wireshark >/dev/null && id -nG "$USER" | tr ' ' '\n' | grep -Fxq wireshark; then
sudo gpasswd -d "$USER" wireshark
else
echo "$USER is not listed in the wireshark group"
fiTo uninstall Wireshark, remove the package and its common files. Include tshark in the same command if you installed the terminal capture package earlier.
sudo apt purge wireshark wireshark-common tsharkapt purge removes the packages and clears the wireshark-common package configuration, including the saved non-root capture prompt state. It does not delete your personal capture profiles.
Verify the installed package state before you move on to source cleanup. If the command prints only the message below, no Wireshark package remains installed.
dpkg -l wireshark wireshark-common tshark 2>/dev/null | grep '^ii' || echo "Wireshark packages are not installed"Wireshark packages are not installed
After package removal, preview any orphan cleanup before accepting it. Continue only if APT’s list contains packages you actually want to remove.
sudo apt autoremove --dry-runIf the preview is limited to unneeded Wireshark dependencies, run the cleanup command without the dry-run flag.
sudo apt autoremoveRemove the Wireshark PPA on Ubuntu
If you used the developers PPA on Ubuntu 24.04 or 22.04, remove the source after the package is gone so APT stops checking it. Ubuntu 22.04 can leave the generated PPA trust files behind, so the exact rm -f line below removes those validated filenames and is harmless on newer releases where they were not created.
sudo add-apt-repository --remove ppa:wireshark-dev/stable -y
sudo rm -f /etc/apt/trusted.gpg.d/wireshark-dev-ubuntu-stable.gpg /etc/apt/trusted.gpg.d/wireshark-dev-ubuntu-stable.gpg~
sudo apt updateCheck that no Wireshark PPA source or trust files remain, then confirm that apt-cache policy falls back to Ubuntu’s own Universe package candidate.
find /etc/apt/sources.list.d /etc/apt/trusted.gpg.d /etc/apt/keyrings /usr/share/keyrings -maxdepth 1 -iname '*wireshark-dev*' -print 2>/dev/null | grep . || echo "No Wireshark PPA source or trust files remain"No Wireshark PPA source or trust files remain
Then inspect the package candidate:
apt-cache policy wiresharkExpected output on Ubuntu 24.04 after removing both the package and the PPA:
wireshark:
Installed: (none)
Candidate: 4.2.2-1.1build3
Version table:
4.2.2-1.1build3 500
500 http://au.archive.ubuntu.com/ubuntu noble/universe amd64 Packages
Package removal does not automatically delete your personal Wireshark profiles. The main per-user directory is usually
~/.config/wireshark, and extra cache or share directories can appear later.
find "$HOME" -maxdepth 3 \( -path "$HOME/.config/wireshark" -o -path "$HOME/.local/share/wireshark" -o -path "$HOME/.cache/wireshark" \) -printDelete only the paths that the command prints and that you no longer need.
Troubleshoot Wireshark on Ubuntu
Most launch and capture problems come down to permissions or a damaged per-user profile.
Fix Missing Capture Interfaces in Wireshark on Ubuntu
If the capture list is empty, start by checking whether your current login session actually sees the wireshark group.
id -nG "$USER" | tr ' ' '\n' | grep -Fx wiresharkwireshark
If the command prints nothing, rerun sudo usermod -aG wireshark $USER, then log out and back in or start a new shell with newgrp wireshark. If the group is present but captures still fail, recheck dumpcap:
getcap /usr/bin/dumpcap/usr/bin/dumpcap cap_net_admin,cap_net_raw=eip
Fix Wireshark Launch Problems on Ubuntu
A stale profile directory is a common reason the GUI opens and closes immediately. Rename the saved profile so Wireshark can build a clean one on the next launch.
mv ~/.config/wireshark ~/.config/wireshark.backupLaunch Wireshark again after the rename. If it opens normally, compare the new profile with the backup before copying any custom settings back.
Conclusion
Wireshark is ready on Ubuntu with non-root capture enabled, so you can inspect packets without launching the GUI as root. To widen the workflow, install Nmap on Ubuntu first, then keep a few Nmap scanning commands nearby before you move back into packet analysis.
Concise and clear
Perfect. Thank you for this tutorial.