I'm getting conflicting views about where wireshark should be used to sniff for traffic. Some say to use the gateway to do it and use it to capture non tor traffic, others say to use the workstation to do it. I am aware that there are leak tests where you do it on the gateway. But for the purpose of utmost anonymity and security where should it be done from? And what would the set up be? My drivers aren't loading in whonix at all when i launch wireshark. I used katoolin script to install kali tools on whonix virtualbox platform.
Since Wireshark is to be used for analyzing local Network traffic, using Whonix in this case will not yield you any Advantage in regards to security. Adding to that, please Keep in mind that you should only use such Software on Networks you are allowed to pen-test, in which case anonymity shouldn't be required.