I am using Ubuntu 12.04 LTS. I have experienced a small problem. I installed wireshark 1.8.2 from

ppa:eugenesan/ppa repository.

Since that time when I try to launch it, this error appears" wireshark: symbol lookup error: wireshark: undefined symbol: read_keytab_file . I have same problem with tshark. Wireshark won't launch. Help me two solve this issue.

2 Answers 2


I had this same problem. I solved it by completely removing wireshark and all configurand installing it from source. You can download wiresharks source code here Wireshark Source.


Remove the version from the PPA again to revert to the official Ubuntu supplied version.

  1. Install ppa-purge Install ppa-purge.

  2. Run in the terminal:

    sudo ppa-purge ppa:eugenesan/ppa

    This should remove the PPA from the software sources and it will revert all packages installed from that PPA.

  3. Check the version of the Wireshark package installed. Should read like as follows:

    $ apt-cache policy wireshark
      Installed: 1.6.7-1
      Candidate: 1.6.7-1
      Version table:
     *** 1.6.7-1 0
            500 http://nl.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
            100 /var/lib/dpkg/status

In case you still have issues, force the official Ubuntu version of Wireshark (may be different by the time you read this, so run the command above!):

sudo apt-get install wireshark=1.6.7-1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .