The new version of Wireshark 3.0.0 arrives with a new interface in QT and more

Wireshark (formerly known as Ethereal) is a free network protocol analyzer. Wireshark is used for network analysis and solution, since this program allows us to see what happens on the network and is the de facto standard in many companies commercial and non-profit organizations, government agencies and educational institutions.

This application runs on most Unix operating systems and is compatibles, including Linux, Microsoft Windows, Solaris, FreeBSD, NetBSD, OpenBSD, Android, and Mac OS X.

This program It has an easy-to-use interface that can help us to interpret the data of hundreds of protocols in all the different types of main networks.

These data packets can be viewed in real time or analyzed offline, with dozens of capture / trace file formats including CAP and ERF.

About the new version of Wireshark 3.0.0

Few hours ago a new branch of Wireshark 3.0.0 network has been released in which one of the main novelties is that Wireshark 3 removes the implementation of the old GTK + based user interface.
Well now in this last branch thrown lto Wireshark 2 UI, moved from GTK + to Qt, although the old interface was available as optional (for those who prefer this previous one).

The new interface is no longer compatible with Qt 4.x, now at least Qt 5.2 is required for the operation.

Greater support

This new version of Wireshark 3.0.0 adds initial support for PKCS # 11 tokens to decrypt RSA to TLS and also for repeatable builds, allowing any user to verify that the proposed binary builds are based on the published source code.

In addition, added support for timestamp conversion for UDP / UDP-Lite protocols and support for using a proxy for SSH connections to the sshdump and ciscodump extcap interfaces.

With this the developers have enabled the ability to decrypt DTLS and TLS from pcapng files, including DSB with captured keys.

New formats

An important point that we would like to highlight is that developersAdded to the build system support for generating self-contained installation packages in AppImage format.

New modules added

In Wireshark 3.0.0 the TCP analysis module, the configuration "Reassemble segments out of order" has been added, which allows you to solve problems with the analysis and decryption of flows when the segments are out of order.

In addition, WireGuard Dissector module added to decrypt WireGuard VPN traffic (if you have keys).
The BOOTP parser module is renamed to DHCP and the SSL module to TLS.

How to install Wireshark 3.0.0 on Ubuntu and derivatives?

At this time version 3.0.0 has not yet been updated in the official PPA of the application. But this will not take long since it is only a matter of hours for this to be updated.

At the moment the only method to install this new version is by downloading the source code of the application and compiling Wireshark 3.0.0 on your system.

If you like it that way, for now you can add the official repository of the application to your system. This can be added by opening a terminal with Ctrl + Alt + T and executing:

sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update

Later to install the application just type the following in a terminal:

sudo apt-get install wireshark

It is important to mention that During the installation process there are a series of steps to follow that implement the Separation of Privileges, allowing the Wireshark GUI to run as a normal user while the dump (which is collecting packets from its interfaces) runs with the required elevated privileges for tracking.

In case you answered negatively and would like to change this. To achieve this, in a terminal we are going to type the following command:

sudo dpkg-reconfigure wireshark-common

Here we must select yes when asked if non-superusers should be able to capture packets.

In case this does not work, we can remedy this problem by executing the following:

sudo chgrp YOUR_USER_NAME /usr/bin/dumpcap
sudo chmod +x /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap

Finally, we just have to look for the application in our applications menu in the tools section or on the Internet and we will see the icon there to be able to run it.