Geek Answers Handbook

The error "does not open" when running wirehark on the Ubuntu command line

I installed wirehark on Ubuntu, When I launched it:

/usr/bin/wireshark

I get an error message:

 (wireshark:27945): Gtk-WARNING **: cannot open display:

I want to run wirehark on the command line.

I do not want to use the user interface. I'm not sure why he complains about the display, I want to run it on the port.

+4
source share
2 answers

You can try tshark - this is the "console explorer" that is part of the wirehark project.

You should read "Read man tshark .

For example, to capture an http packet when running 80 ports:

 tshark -f 'tcp port 80 and http'

PS An example has been fixed to use a capture filter instead of a display filter.

+5
source

Ubuntu runs a proxy server that complains about mapping:

 el@apollo :~$ wireshark (wireshark:20619): Gtk-WARNING **: cannot open display:

Set the DISPLAY environment variable:

 export DISPLAY=:0.0 /usr/bin/wireshark

Then it works:

 el@apollo :~$ wireshark -Y wireshark: option requires an argument -- 'Y' Usage: wireshark [options] ... [ <infile> ] Capture interface: -i <interface> name or idx of interface (def: first non-loopback) -f <capture filter> packet filter in libpcap filter syntax -s <snaplen> packet snapshot length (def: 65535) -p don't capture in promiscuous mode -k start capturing immediately (def: do nothing) -S update packet display when new packets are captured -l turn on automatic scrolling while -S is in use -I capture in monitor mode, if available -B <buffer size> size of kernel buffer (def: 2MB) -y <link type> link layer type (def: first appropriate) -D print list of interfaces and exit -L print list of link-layer types of iface and exit

wireshark is an X application, so it needs to know where to send the output of the X11 display.

+3
source

More articles:


All Articles