Intro to Wireshark Tutorial // Lesson 3 // Capturing Packets with Dumpcap

Let's continue with our Intro to Wireshark course with lesson 3 - learn how to capture traffic from the command line with Dumpcap. In high-throughput environments, or for those that like to use tools from the command line, this is a great way to bring in traffic for later analysis.
We will learn how to select an interface, save the pcap, and store traffic in a ring buffer.
Temporary path command on MacOS: PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/Wireshark.app/Contents/MacOS
Permanent addition to shell path on MacOS:
wpbeaches.com/how-to-add-to-t...
Permanent path entry on Windows 10:
helpdeskgeek.com/windows-10/a...
More info on dumpcap options:
www.wireshark.org/docs/man-pa...
Please smash the like button to let me know if you dig this content!
== More On-Demand Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...
Chapters in video:
0:00 Intro
0:58 Adding Command Line tools to Path
4:30 Capturing traffic with dumpcap
6:25 Writing traffic to a file
7:12 Writing traffic to a ring buffer
10:27 Why use the command line instead of Wireshark GUI?

[@ChrisGreer]

Let's learn how to capture traffic from the command line with dumpcap. In high-throughput environments, or for those that like to use tools from the command line, this is a great way to bring in traffic for later analysis. Want Wireshark training on-demand? ----------------------FREE ON DEMAND TRAINING ------------------------------- ▶Getting Started with Wireshark (Intro Course) - bit.ly/wiresharkprotocols​ ▶Foundational TCP with Wireshark - bit.ly/wiresharktcp​ ▶Mastering TCP with Wireshark - bit.ly/mastertcp​ ▶Protocol Deep Dive: QUIC - bit.ly/wiresharkquic

[@debasishdash3531]

You are an amazing teacher Chris.

[@_K_W]

Awesome Chris. I’m in a bootcamp and network analysis and packet capture is the topic. Exposed to about 5-6 command line setups like tshark, termshark, windump and now wireshark. Your videos are helping me put it together

[@richardhyman6981]

Another excellent video! I really appreciate how much I'm able to learn via the way you explain and demonstrate concepts.

[@ChrisGreer]

Glad you like it

[@ItsBigTexYall]

Chris, these are great man. I've used TCPDump quite a bit in the past on a firewall CLI, but have no hands on with Wireshark. I started with your first video. This is one of the most comprehensive training videos I've seen on the subject. Thank you for the hard work you put into these!

[@ChrisGreer]

Thank you! It is work - but I appreciate comments like these. Please let me know if you like the rest of the series.

[@ItsBigTexYall]

@@ChrisGreer I’m sure I will enjoy the rest; I’m on video 5 and should finish the series today. I’m already eyeing some of your other videos. I’ll be sure to share your channel with coworkers! Thanks again Chris!

[@user-ih7yv7bw8q]

I really like your videos and the great explanation you give.

[@kathw-fg1sr]

Excellent class. Thank you so much.

[@davidli4598]

Thank you very much Chris!

[@vyasG]

Thank you for this Informative video.

[@ChrisGreer]

You are welcome!

[@HollyTroll]

really useful info... thank you so much

[@mrbrown6421]

Excellent.

[@TheNovum]

Good stuff! And just about right lenght on the Vidos.. I am going to learn this!!

[@ChrisGreer]

Thanks for the comment!

[@jjames7206]

Thanks Chris.

[@ChrisGreer]

You bet! Thanks for the comment J

[@charlesakwasiopoku7656]

Thanks Chris

[@dannydominguez6815]

Not sure about MACs, but in Windows when you edit the system properties, a restart is required for changes to take effect. 3:25

[@elva136]

Thank you!

[@ChrisGreer]

You're welcome - thanks for the comment.

[@mikehimself909]

Thanks for the great content! BTW - the command line may be good for scheduling captures (e.g. with cron and the like) :)

[@yaserbasaad7984]

Thanks a lot

[@ChrisGreer]

Most welcome

[@siakaouattara8010]

Hey Chris, I'm using windows 11. Been trying to capture using cmd prompt, but every time I provide the directory dumpcap reply " the file to which the capture would be saved could not be opened : permission denied " how do I activate the permission ? Thanks 😊

[@AmmarAlIessa]

Another solid reason why you need to run Wireshark using command line is when there is an unusual behavior that happens randomly like once every two or three or four days/weeks at a certain time of the day and there is not a single explanation of why that happens. You may fire up a task scheduler to run the tcpdump command with all the bells and whistles then store the captures in a specific directory on server side. Don't forget to spin up another task scheduler to delete files older than 14 days to avoid filling up your disk drive and you should be good to go: ready for fishing 😉.

[@ChrisGreer]

Nice! Thanks for the comment.

[@keithchapara9994]

Following.

[@sapnachaudhary9418]

Hi Chris, You make really nice videos. I have a request can you make a video of how tcpdump/wireshark is able to capture packets. What is happening in the network stack at which layer these tools work. And what is libcap here.

[@armandomolina2034]

can you apply to make videos for level effect? they can really use you.

[@romemadali84]

awesome, , I've been following this for a long time, do we have a PCAP tutorial for SIP or call issue,

[@ChrisGreer]

Not yet on the SIP tutorial. But good idea for a future video.

[@edision69]

3:22 please can somebody tell me where to find that folder? I just can't find it

[@brayanruelas574]

kzbin.info/www/bejne/o3XHYYt5bK-UebM this tutorial should help

[@daviderosignoli6513]

I need it too!

[@herpderp4780]

same, I'm stuck on the same spot, can't find nftracker folder anywhere looking forward to hearing back Chris and thanks for your videos sir!

[@aqq8123]

I couldn't find it either. However, I just added my Wireshark folder into the path which can be found in This PC> Program>Wireshark. Then I restarted my computer because based on another video I referenced, that helps. Then I ran my command prompt as an administrator, typed "path" and saw Wireshark in there. Furthermore, I confirmed by doing "dumpcap -H" and it worked as opposed to before where it would say "not found" or something. Hope this helped, it worked for me.

[@user-ru8bb4lv5b]

5:27 tshark -D if you are in Linux.

[@dylypickle]

when I try to open (dumpcap -D or dumpcap -i 1) on the terminal it's type: permission denied. im using windows btw

[@91thewatcher23]

You mentioned in the prior video that you would likely not want to install/run the Wireshark directly on a backend server. Would using something from the command line like T-shark or dumpcap tools be a more viable alternative, since they're less resource-intensive?

[@91thewatcher23]

Also, I want to say thank you for putting up these high-quality tutorials. THANK YOU!

[@ChrisGreer]

You are very welcome! Thank you for the comment.

[@ChrisGreer]

Yes, dumpcap should be less resource-intensive, and if I had to, that is the way that I would do the capture on the server side. However, just take the risks into consideration, especially on a production system!

[@soiledpants1499]

These commands worked on Kali too, surprisingly

[@masaksehat24]

Hi chris, would you mind to discuss th topic different between round trip time vs average response time? Thank you

[@ChrisGreer]

Great suggestion - I'll try to work that in. Thank you Nanda

[@adelaioanapopon9880]

Hi Chris, when I try to open (dumpcap -D or dumpcap -i 1) on the terminal it's type: permission deneid?? Any suggestions for me?

[@ChrisGreer]

What OS you using?

[@adelaioanapopon9880]

Linux mint cinnamon on Omen HP. I just started to study cyber security and I just start to use Linux too

[@ChrisGreer]

@@adelaioanapopon9880 And you tried it with "sudo dumpcap -D" as well? As long as your account has sudo privs you should be good.

[@adelaioanapopon9880]

@@ChrisGreer yes it is work! Im still a beginer with linux and wireshark :)

[@jimlevy6290]

MacBook user. Although I have Wireshark installed, I'm getting a zsh: "command not found" error on all dumpcap commands including -D and -h. I searched and am unable to find any solutions. It would be great if you could let me know what the problem is. Fantastic series of videos.

[@mehmetyiter899]

me too , have same problem

[@ehedhesenli9714]

same problem when I wrote dumpcap -h it says command not found@@mehmetyiter899

[@martinbaranek8455]

You said you are going to create variable for Wireshark directory in path. But you used nftracker. Why is that?

[@zsahe21]

!!!!!

[@redpillblupill]

goddamnit WHAT ABOUT LINUX?!?!?! We're frequently left out and here we are yet again NOT being included in a tutorial for software which DOES RUN on it! can't even get the program to START CAPTURING in the first place. (and yes, I did make this SAME comment not even 30mins ago on the previous video) "Couldn't run /usr/bin/dumpcap in child process: Permission denied"

[@ChrisGreer]

Greetings - I know that you know I can't demonstrate all OS's in a short video. But, let's get you working - here is what a quick Google search revealed about the error you see - techoverflow.net/2019/06/10/how-to-fix-wireshark-couldnt-run-usr-bin-dumpcap-in-child-process-permission-denied-on-linux/

[@baluhyajr.913]

.

[@jwfventures4239]

Chris your tutorials are outstanding. I am having one issue trying to save using the command prompt I have a Windows 10 machine. When I type: C:\Program Files\Wireshark>dumpcap -i 5 -w users/Documents/Drew/Data/sample.pcapng The file to which the capture would be saved ("users/Documents/Drew/Data/sample.pcapng") could not be opened: No such file or directory. When using the application interface I was able to save a file. The direct path was This PC > Documents > Drew > Data > test_00001_20210724165329 However, again, when trying to save via the Command Prompt I am not able to save. I realize your time is valuable, and the amount of questions you get staggering. Any assistance or direction would be greatly appreciated.

[@ChrisGreer]

Hey JWF! Thanks for the comment and for the question. Are you running a command line as administrator? Just wondering if we can rule that out.... www.laptopmag.com/articles/open-windows-10-command-prompt-administrator-privileges

[@jwfventures4239]

Wow Chris, you are a legend and to get a reply in due time is incredible. To let you know, I decided to not use Wireshark with Admin control, since I am the only one using the computer, and I wanted to keep my learning curve as simple as possible. Would that cause the issue? Meaning should I be doing these command prompts at the Admin level? or would that not matter? Your videos are outstanding, and I am prepping for my COMPtia Network+ exam, and want to have practical experience using this well known and broadly used app. Hopefully my response can help you zero in, or drill down into why the command line approach is giving me that issue. Thanks again my brother. You are outstanding !!!

[@bluejuice2503]

Hi JWF, Just in case others have this issue. For windows I would recommend using the full path name anytime you reference a location. Also I would create a folder just of C: drive. Less chance of typo when typing it in. For example: I created a folder on C: drive called Captures so for me the syntax would be: dumpcap -i 5 -w "c:\captures\sample.pcapng" - note the direction of the folder separators \ - the path (within the " ") in windows is case insensitive - The path statement is enclosed in " " just to be safe... it is required if a spaces are used. For example if I created a folder called "wireshare captures" then the syntax would be: dumpcap -i 5 -w "c:\wireshark captures\sample.pcapng" I hope that helps someone :) Thanks Chris for the guides. I really appreciate the effort you put into helping others learn WS ... I have watched your shark fest streams and they are awesome!