Wireshark

v4.2.2Wireshark Foundation (formerly Ethereal)

The standard protocol analyzer. Opens capture files, dissects hundreds of protocols, follows TCP/HTTP streams, and filters with display syntax. The range ships the console tools (tshark, capinfos, editcap, mergecap) plus the graphical pane over the authored PCAPs attached to a scenario.

Category: Packet & network traffic analysis
Package: wireshark
Runs on: Linux · Windows
Commands: wireshark, tshark, capinfos, editcap, mergecap, dumpcap

Reads authored capture fixtures. Live capture is simulated from the scenario's own traffic model; no interface is opened.

Install it

The scripts below install the real Wireshark Foundation (formerly Ethereal) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-wireshark.sh

Windows installer (PowerShell)

Install-wireshark.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Wireshark
```
sudo apt install -y wireshark
```

RHEL, Fedora (dnf)

Install Wireshark
```
sudo dnf install -y wireshark
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Wireshark
```
sudo pacman -S --noconfirm wireshark
```

Alpine (apk)

Install Wireshark
```
sudo apk add wireshark
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which wireshark
```
Check the version
```
wireshark --version
```
The range reports 4.2.2.

Remove it

Take it off again
```
sudo apt remove --purge wireshark
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search wireshark
```
Install Wireshark
```
winget install --id wireshark -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Wireshark
```
choco install wireshark -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where wireshark
```
Check the version
```
wireshark --version
```
The range reports 4.2.2.

Remove it

Take it off again
```
winget uninstall --id wireshark
```

Inside the range

Tick it on the launch screen
Under Wireshark's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y wireshark
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Wireshark

Reps: Triage the DropperFive files, one intrusion. Hash and type each artifact, carve its strings, run the YARA starter pack, and write a rule that catches the packed dropper without flagging the two known-good controls.
Reps: Dead Box and Live RAMOne sample, one memory capture, one report. Hash and scan the dropper with real YARA, then run upstream Volatility 3 locally against a selected dump to find what pslist will not show you — and submit the findings.
Reps: Follow the PacketsA finance workstation is beaconing and someone pushed an archive to the file server in the clear. Take the capture off the span port, filter it down, follow the streams, and write up what left the building.
Reps: What the Capture Won't SayA staff member typed their password into a lookalike login page, and the proxy logs show only an encrypted session. Take the capture off the span port and prove where the credentials went using the one part of TLS that is still readable: the handshake. You are graded on what you can show, not what you guess.
Reps: The Other StackInvoices left the finance VLAN, but every IPv4 watchlist stayed quiet. Take the capture off the span port and find the traffic the rules were never written for: the IPv6 stack running beside the one everyone watches. You are graded on reading neighbor discovery, the AAAA lookup and the v6-only upload.
Reps: The Chatty SensorA second reader appeared on the plant-floor segment and started receiving every sensor reading the broker publishes. Take the capture off the span port, read the MQTT conversations and name the intruder, the topic it subscribed to and the credential the sensors hand out in the clear. You are graded on what the protocol itself shows you.
What the Anvil DidThe overnight triage agent answered tickets on its own. One of those tickets told it to go somewhere. Capture the agent plane live, follow what it called, and say what happened.
Haunted: The Pumpkin Patch BeaconFacilities lit the car park with forty orange smart plugs for the season. One of them holds a socket open to a host in Riga every 300 seconds. Work the packet capture and the DHCP lease table until you can name the plug and the callback.
Pentest: Wireless AssessmentSit in an authorized coffee-shop parking lot, sweep the 2.4/5 GHz bands, capture the guest-WPA2 handshake, crack it against a scoped wordlist, then file a rotation-and-802.1X finding on the corporate SSID.