You need to run wireshark as root. I'm not sure whether the launcher is set to do this yet but try plugging this into a terminal:
gksu wireshark
To make life easier on yourself, I suggest you edit the launcher (right click the menu → click edit menus → find wireshark and change prepend its command with gksu
).
Alternatively, you can use setcap
to allow non-root users to use dumpcap
(the application that does all the capturing that WireShark uses):
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
This is essentially from the WireShark Wiki. I had seen this before I posted the above but I wasn't confident in it. After seeing it again in the comments, I gave it a test today and it appears to work.
This has a security issue too, though...
Any user or process on the system can now monitor network traffic without user intervention. Think exploited service or genuine user. The wiki does have another setting where you can limit dumpcap
to one group of users (and you add your account to that group) but this is only marginally better. What happens if your browser has an exploitable flaw, that allows somebody to fire off commands (does occasionally happen)?
In my eyes this is more of a security risk than going through gksu
. At least that way you need to enter a password.