I installed wireshark (tshark) using

sudo apt-get install tshark 

this installed the tshark executable in /usr/bin/tshark.

The problem now is that I am unable to run it without root permissions. How can I execute this command using the permissions of a normal user?

0

4 Answers

You'll need to configure wireshark to allow non-root-users to capture packets:

dpkg-reconfigure wireshark-common

Add yourself to the wireshark group:

sudo usermod -a -G wireshark "$USER"

Restart your system so the group permissions will be applied. Now you can start wireshark and capture some packets!

1

The Wireshark wiki discusses permissions and ways to "circumvent" them if needed - although I'm pretty sure that any packet capturing on Linux would require root at some level.

I had a similar issue with not being able to see any network interfaces when running Wireshark (tshark's GUI cousin) as a non-root user. Nowadays, Ubuntu and Debian support file capabilities with which I was able to get Wireshark (and tshark) running as non-root.

1. Create a wireshark group.

   sudo groupadd wireshark 

2. Add your username to the wireshark group.

   sudo usermod -a -G wireshark yourusername

3. Change group ownership of dumpcap to wireshark group.

   sudo chgrp wireshark /usr/bin/dumpcap

4. Set file permissions of dumpcap to 754 (rwx for user, r-x for group).

   sudo chmod 754 /usr/bin/dumpcap

5. Enable file capabilities for dumpcap.

   sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

6. You may also need to run dpkg-reconfigure for wireshark-common if you install Wireshark or tshark as a package through Synaptic and enable packet capture for non-root users.

   sudo dpkg-reconfigure wireshark-common

2

It will probably need root credential to put the network card into premiscious mode. You need to set the user id or run it with sudo. Sudo is the better, more secure, option.

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy