Home / ubuntu / Questions / 1403877
In Process
An old man in the sea.
Asked: 2022-04-23 12:45:55 +0800 CST

Allowing wireshark to capture only for certain users doesn't seem to work

  • 772

I've answered yes to sudo dpkg-reconfigure wireshark-common, and done the following:

sudo usermod -a -G wireshark my_username

groups my_username confirms that I'm in the group.

sudo chgrp wireshark /usr/bin/dumpcap

sudo chmod 770 /usr/bin/dumpcap

Runing ls -l for that file gives

-rwxrwx--- 1 root wireshark 113112 abr 19  2020 /usr/bin/dumpcap

and finally

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

However, only when I change the dumpcap file permissions to be executed by any user, do I manage to start capturing packets.

Why is this?

permissions

1 Answers

  1. I never had a problem with capturing data using Wireshark or tshark when I followed the instructions.

    1. Add a wireshark group to the selected user: sudo usermod -a -G wireshark my_username
    2. Do not change the owners of the files or any permissions (dumpcap etc.).
    3. Log out and log in again, or restart the PC to apply the new group settings.
    4. Use Wireshark or tshark without elevated privileges to capture data. Capture takes place without problems and errors.
    5. Users without the wireshark group are not able to capture data. In Wireshark, they do not see the network interfaces, tshark reports an error.
    • 0