I wanted to install Ethereal on a CentOS Linux system to sniff network traffic to try to resolve a problem for a website. I have tcpdump on the system, but I wanted to have a GUI tool to make analyzing the packets a little easier for me.
I ran yum install ethereal, which installed wireshark
and its dependency, libsmi. Wireshark was installed, because
development of ethereal has stopped and the core development team is now
developing wireshark.
The FAQ for wireshark offers the following explanation of the name change.
In May of 2006, Gerald Combs (the original author of Ethereal) went to work for CACE Technologies (best known for WinPcap). Unfortunately, he had to leave the Ethereal trademarks behind.
This left the project in an awkward position. The only reasonable way to ensure the continued success of the project was to change the name. This is how Wireshark was born.
Wireshark is almost (but not quite) a fork. Normally a "fork" of an open source project results in two names, web sites, development teams, support infrastructures, etc. This is the case with Wireshark except for one notable exception -- every member of the core development team is now working on Wireshark. There has been no active development on Ethereal since the name change. Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline.
After the installation completed, I tried running wireshark by issuing
the command wireshark.
# wireshark bash: wireshark: command not found
I then discovered that installing the wireshark
RPM only installs
a command line program, tshark. The program was installed in
/usr/sbin/tshark. You can obtain help on
tshark using man tshark or tshark -h.
There is also documentation installed in /usr/share/wireshark/help.
I had to install wireshark-gnome to get the GUI version, which
I did with yum -y install wireshark-gnome. I could then start
the GUI version from a shell prompt with wireshark or start it
by clicking on Applications, Internet, and then
Wireshark Network Analyzer.
Since I wanted to capture only HTTP
traffic, I typed HTTP in the Filter field and
then clicked on the Apply button. I then clicked on Capture,
Interfaces, and clicked on the Start button next to the
eth0 interface to start capturing all HTTP traffic.
