Portainer Templates logo

Portainer Templates

Wireshark Wireshark

Network

Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.

Image details

Pulls: 1.8M
Architectures: amd64, arm64
Image size: 636 MB
Latest: 4.6.6
User: linuxserver
Created: Apr 01, 2020
Updated: 4 hours ago
Status: active

Configuration

Type
Container
Platform
linux
Image
linuxserver/wireshark:latest
Ports
80:80/tcp3000:3000/tcp3001:3001/tcp
Volumes
/config : /srv/lsio/wireshark/config
Env vars
PUID=1000PGID=1000TZ=Etc/UTC
Restart
unless-stopped

Template by technorabilia

Notes

Portainer App Templates by Technorabilia, based on data provided by LinuxServer.io.

Ensure to create the following volume directories on the host file system, or modify the paths in the volume mapping section under the advanced options below, as needed.

mkdir -p /srv/lsio/wireshark/config

Installation

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select the app you wish to deploy, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo

docker run -d --name Wireshark \
  --network host \
  -p 80:80/tcp \
  -p 3000:3000/tcp \
  -p 3001:3001/tcp \
  -e 'PUID=1000' \
  -e 'PGID=1000' \
  -e 'TZ=Etc/UTC' \
  -v /srv/lsio/wireshark/config:/config \
  --restart=unless-stopped \
  linuxserver/wireshark:latest

Save this file as compose.yaml and run docker compose up -d
Use this only as a guide.

services:
  wireshark:
    image: linuxserver/wireshark:latest
    ports:
      - 80:80/tcp
      - 3000:3000/tcp
      - 3001:3001/tcp
    volumes:
      - /srv/lsio/wireshark/config:/config
    environment:
      PUID: '1000'
      PGID: '1000'
      TZ: Etc/UTC
    network_mode: host
    restart: unless-stopped

Save each file below into a folder, then run kubectl apply -f .
Written for k3s, but works on any cluster: bind mounts use hostPath, named volumes get a persistent volume claim, and ports are exposed via a LoadBalancer service.

wireshark-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wireshark
  labels:
    app: wireshark
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wireshark
  template:
    metadata:
      labels:
        app: wireshark
    spec:
      hostNetwork: true
      containers:
        - name: wireshark
          image: linuxserver/wireshark:latest
          env:
            - name: PUID
              value: '1000'
            - name: PGID
              value: '1000'
            - name: TZ
              value: Etc/UTC
          ports:
            - containerPort: 80
              protocol: TCP
            - containerPort: 3000
              protocol: TCP
            - containerPort: 3001
              protocol: TCP
          volumeMounts:
            - name: wireshark-data-0
              mountPath: /config
      volumes:
        - name: wireshark-data-0
          hostPath:
            path: /srv/lsio/wireshark/config

Save this file as ~/.config/containers/systemd/wireshark.container

[Unit]
Description=Wireshark

[Container]
Image=linuxserver/wireshark:latest
ContainerName=wireshark
PublishPort=80:80/tcp
PublishPort=3000:3000/tcp
PublishPort=3001:3001/tcp
Environment=PUID=1000
Environment=PGID=1000
Environment=TZ=Etc/UTC
Volume=/srv/lsio/wireshark/config:/config
Network=host

[Service]
Restart=always

[Install]
WantedBy=default.target

Then reload systemd and start the service:

systemctl --user daemon-reload
systemctl --user start wireshark

For a system-wide service, use /etc/containers/systemd/ and drop --user.

For more installation options, see the Documentation in our GitHub repo

linuxserver/wireshark

This readme has been truncated from the full version found HERE

Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.

Application Setup

In order to dump from an interface you will need to pass NET_ADMIN at a minimum, optionally you can use host networking to capture from your host level device or specify a Docker network you want to capture from.
The application can be accessed at:
  • https://yourhost:3001/

Usage

docker run -d \
  --name=wireshark \
  --net=host \
  --cap-add=NET_ADMIN \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Etc/UTC \
  -p 3000:3000 `#optional` \
  -p 3001:3001 `#optional` \
  -v /path/to/wireshark/config:/config \
  --shm-size="1gb" \
  --restart unless-stopped \
  lscr.io/linuxserver/wireshark:latest

Serve Wireshark on your own domain behind Caddy, Nginx or Traefik. Fill in your domain and copy the result. It's a starting point, some apps need their own base URL or extra headers set too.

Proxying wireshark.example.com to http://localhost:80

Add this to your Caddyfile

wireshark.example.com {
	reverse_proxy http://localhost:80
}

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs Wireshark
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Runs on the host network

This container shares your server's network directly, so port mappings are ignored and every port the app opens binds straight to the host.

  • If a port won't bind, find the clash with sudo ss -tlnp and stop the other service, or change the port in Wireshark's own settings.

Running but the page won't load

The container is up but nothing appears in your browser.

  • Use your server's real IP: http://your-server-ip:80. The 0.0.0.0 link Portainer shows isn't a real address.
  • Give it a minute after first deploy, Wireshark can take a while to initialise.
  • Make sure your firewall allows the port, e.g. sudo ufw allow 80

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

  • Fix the ownership: sudo chown -R 1000:1000 /srv/lsio/wireshark/config
  • Or set the PUID and PGID variables (defaults 1000:1000) to match your own user, found with id $USER

Image won't pull

Test the pull directly on the host: docker pull linuxserver/wireshark:latest

  • "manifest unknown" means the tag no longer exists. This template uses latest, so try pinning a specific version instead.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

  • Check the logs right after a restart, the last few lines before it died are the useful ones.
  • Get the exit code with docker inspect Wireshark --format '{{.State.ExitCode}}'
  • Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

Similar apps

Adguardhome-sync Adguardhome-sync NetworkCheckmate Checkmate NetworkDdclient Ddclient NetworkDuckdns Duckdns NetworkFail2ban Fail2ban Network iperf NetworkNetAlertX NetAlertX NetworkNginx Proxy Manager (stack) Nginx Proxy Manager (stack) Network