Home / ubuntu / Questions / 458762
In Process
Janghou
Asked: 2014-05-02 01:00:39 +0800 CST

How to enable Wireshark without running as root in Trusty 14.04

  • 772

I installed Wireshark. Running as root is not recommended, so

I Did 

sudo dpkg-reconfigure wireshark-common

According to:

http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

http://anonscm.debian.org/viewvc/collab-maint/ext-maint/wireshark/trunk/debian/README.Debian?view=markup

Answered Yes, Logout out Started Wireshark and got this message:

couldn't run /usr/bin/dumpcap in child process: Permission Denied.

I think I followed the recommended way of configuring Wireshark, it worked in 13.10, it doesn't in 14.04

FYI, reconfiguring wireshark-common is actually setting the group for dumpcap to Wireshark. Still it doesn't work. I checked that.

How should it be done in 14.04?

networking

3 Answers

  1. I found that after running:

    sudo dpkg-reconfigure wireshark-common

    a wireshark group been created in /etc/gshadow. So I just wrote: 

    sudo gpasswd -a $USER wireshark

    and logout/login and now it works fine!

    • 81

  2. Yes, you did correct. But some thing is missing.If you see the error message like couldn't run /usr/bin/dumpcap in child process: Permission Denied.Go to terminal and 

    sudo dpkg-reconfigure wireshark-common

    choose answer as "YES" .Then add user to the group by 

    sudo adduser $USER wireshark

    Then restart your machine and open wireshark. It works.

    • 26 
  3. sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

    Check this question

    • 3