2
3
I installed wireshark (tshark) using
sudo apt-get install tshark
this installed the tshark executable in /usr/bin/tshark.
The problem now is that I am unable to run it without root permissions. How can I execute this command using the permissions of a normal user?
Vidya
Posted 2009-12-10T05:07:04.660
Reputation: 149
3
The Wireshark wiki discusses permissions and ways to "circumvent" them if needed - although I'm pretty sure that any packet capturing on Linux would require root at some level.
2
You'll need to configure wireshark to allow non-root-users to capture packets:
dpkg-reconfigure wireshark-common
Add yourself to the wireshark group:
sudo usermod -a -G wireshark "$USER"
Restart your system so the group permissions will be applied. Now you can start wireshark and capture some packets!
MichielB
Posted 2009-12-10T05:07:04.660
Reputation: 231
1
I had a similar issue with not being able to see any network interfaces when running Wireshark (tshark's GUI cousin) as a non-root user. Nowadays, Ubuntu and Debian support file capabilities with which I was able to get Wireshark (and tshark) running as non-root.
Create a wireshark group.
sudo groupadd wireshark
Add your username to the wireshark group.
sudo usermod -a -G wireshark yourusername
Change group ownership of dumpcap to wireshark group.
sudo chgrp wireshark /usr/bin/dumpcap
Set file permissions of dumpcap to 754 (rwx for user, r-x for group).
sudo chmod 754 /usr/bin/dumpcap
Enable file capabilities for dumpcap.
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
You may also need to run dpkg-reconfigure for wireshark-common if you install Wireshark or tshark as a package through Synaptic and enable packet capture for non-root users.
sudo dpkg-reconfigure wireshark-common
Jun_in_Jeju
Posted 2009-12-10T05:07:04.660
Reputation: 44
0
It will probably need root credential to put the network card into premiscious mode. You need to set the user id http://www.zzee.com/solutions/linux-permissions.shtml#setuid or run it with sudo. Sudo is the better, more secure, option.
stimms
Posted 2009-12-10T05:07:04.660
Reputation: 848
I'm not sure why you think 'sudo is the better, more secure option'. Also if you start Wireshark like that on Debian/Ubuntu, you'll get all kinds of nasty error messages. – MichielB – 2015-11-24T15:46:41.567
1the wireshark group and the permissions will be set by
dpkg-reconfigure wireshark-common– MichielB – 2015-11-24T19:51:19.040refer to the great wireshark wiki regarding capture privileges. Look at the section titled, "Limiting capture permission to only one group"...
– Jun_in_Jeju – 2012-07-03T13:03:21.207