Wireshark Installation on Bluefin#

Wireshark on Bluefin requires choosing between three approaches — Flatpak (file analysis only), Homebrew CLI tools, or a Distrobox container — each with distinct trade-offs around packet capture capability and system integration.

Options at a Glance#

Flatpak — GUI Without Capture#

The Flathub Wireshark package explicitly does not support capturing data — it can only open and analyze existing capture files (.pcap, .pcapng, etc.) 1. This is a Flatpak sandbox limitation: dumpcap requires CAP_NET_RAW / CAP_NET_ADMIN, which the Flatpak sandbox does not grant.

Use this if: you receive capture files from another machine and need the Wireshark GUI for analysis.

Homebrew — CLI Capture (tshark, dumpcap)#

The wireshark Homebrew formula is available on Linux (ARM64 and x86_64) and installs the command-line tools: tshark, dumpcap, editcap, capinfos 2.

brew install wireshark

After install, grant dumpcap the necessary capabilities (adjust path to $(brew --prefix)/bin/dumpcap):

sudo setcap cap_net_raw,cap_net_admin+eip $(brew --prefix)/bin/dumpcap

Note: The wireshark-app Homebrew Cask (graphical application) is macOS-only — the cask artifact types app and pkg are macOS-specific and cannot be installed on Linux 3.

Use this if: you need live packet capture and are comfortable with tshark/dumpcap on the command line.

Distrobox Container — Full GUI + Capture#

For a full GUI experience with live capture, a Distrobox container from a distribution that packages Wireshark natively (e.g., Fedora, Ubuntu) is the most Bluefin-idiomatic approach. Container-based tooling is the preferred pattern for software that doesn't fit Flatpak well 4.

Distrobox supports passing extra flags to the underlying container runtime 5. You can pass capabilities using --additional-flags:

distrobox create --name wireshark-box \
  --image fedora:latest \
  --additional-flags "--cap-add=NET_RAW --cap-add=NET_ADMIN"
distrobox enter wireshark-box
# Inside the box:
sudo dnf install -y wireshark

Note: A rootful Distrobox container makes container root equivalent to host root. Evaluate the security implications before enabling NET_RAW/NET_ADMIN.

Why Not rpm-ostree Layering?#

Local package layering is explicitly an anti-pattern in Bluefin — LockLayering=true is the default in /etc/rpm-ostreed.conf. Layering Wireshark via rpm-ostree increases update time, requires manual maintenance as the package archive evolves, and is the pattern Bluefin is moving away from. Use containers instead.

If you must layer temporarily:

# Edit /etc/rpm-ostreed.conf: set LockLayering=false
sudo rpm-ostree install wireshark

rpm-ostree reset + reboot restores the system to pure image mode 6.

References#

• Wireshark on Flathub — confirms no capture support 1
• Homebrew wireshark formula — Linux bottles, CLI tools only 2
• Homebrew Cask Cookbook — platform artifact types 3
• Bluefin Administration Guide — Local Layering 4
• Distrobox distrobox-create — --additional-flags 5
• Flathub Permissions Docs 7