This feature is only available on Windows at the moment - Wireshark’s official documentation recommends that Linux users use an SSH tunnel.įirst, you’ll have to install WinPcap on the remote system. This is where Wireshark’s remote capture feature comes in. For example, you may want to capture traffic from a router, server, or another computer in a different location on the network. Wireshark captures traffic from your system’s local interfaces by default, but this isn’t always the location you want to capture from. If you’re using Linux or another non-Windows operating system, just create a shortcut with the following command, or run it from a terminal to start capturing immediately:įor more command-line shortcuts, check out Wireshark’s manual page. The -i option specifies the interface, while the -k option tells Wireshark to start capturing immediately. Add -i # -k to the end of the shortcut, replacing # with the number of the interface you want to use. You’ll need to know the number of the network interface you want to use, based on the order Wireshark displays the interfaces.Ĭreate a copy of Wireshark’s shortcut, right-click it, go into its Properties window and change the command line arguments.

You can create a special shortcut using Wirshark’s command-line arguments if you want to start capturing packets without delay. You can enable this setting by opening the preferences window from Edit -> Preferences, clicking the Name Resolution panel and clicking the “ Enable Network Name Resolution” check box. The downside is that Wireshark will have to look up each domain name, polluting the captured traffic with additional DNS requests. When you enable this option, you’ll see domain names instead of IP addresses whenever possible. Wireshark can automatically resolve these IP address to domain names, although this feature isn’t enabled by default.

How to save as pcap wireshark