Python by itself is a strong Programming Language but if you want more than lines of codes and Grphical User Interface for users to interact with, you need a GUI framework. PyQt is one of the GUI frameworks for Python Developers. Qt by itself is a set of C++ libraries and tools. PyQt is Python binding to work with Qt.
Below is some of the guidelines installing PyQt5 on Debian Linux. In some Linux Distros where you have two different versions of Python, 2.7 and 3, make sure you use Python3. Python 2.7 is not officially supported past 2020 anyways so its a good idea to stick with Python3.
Check Python Version
$python3 --version it should show something like $python 3.7.3 if you are not already on Python 3.7, install the latest $sudo apt install python 3.7
There are different ways you can capture Network traffic using Wireshark. 1) Locally on host interface 2) Wire Tapping 3) Port Mirroring or SPAN
1) Simplest way of capturing traffic from local traffic (your own computer). Just select the interface that you want to monitor and hit RUN. Nothing is simpler.
2) Wire Tapping Another sneaky way of capturing the traffic is to tap the wire. Instead of Network devices connected directly to each other, simply put a device in between. Devices like below will do the job. Connect to this device with your wireshark computer and start capturing.
3) Port Mirroring Switchport analyzer or SPAN is feature on Cisco switches where you can forward the captured packets from one interface to another for monitoring and analyzing. Its simple to set up, on the device you want to set up span, configure as per below. in below config, fa0/1 will be the interface we want to capture and the packets will be forwarded to fa0/24. A Wireshark PC will be connected to fa0/24.
#config t #monitor session 1 source int fa0/1 both #monitor session 1 destination int fa0/24 #do show monitor
If you want to read more about SPAN, below is a link from Cisco on it. https://www.cisco.com/assets/sol/sb/Switches_Emulators_v2_3_5_xx/help/250/index.html#page/tesla_250_olh/span_overview.html
The SPAN feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer. The network analyzer can be a Cisco SwitchProbe device or other Remote Monitoring (RMON) probes. Port mirroring is used on a network device to send a copy of network packets, seen on a single device port, multiple device ports, or an entire VLAN, to a network monitoring connection on another port on the device. This is commonly used when monitoring of network traffic, such as for an intrusion-detection system, is required. A network analyzer, connected to the monitoring port, processes the data packets. The device can mirror up to four interfaces per session.A packet, which is received on a network port and assigned to a VLAN that is subject to mirroring, is mirrored to the analyzer port even if the packet was eventually trapped or discarded. Packets sent by the device are mirrored when Transmit (Tx) mirroring is activated.Mirroring does not guarantee that all traffic from the source port(s) is received on the analyzer (destination) port. If more data is sent to the analyzer port than it can support, some data might be lost.
