3

Is it possible to capture packets without superuser?

This is what I see in the wikipedia article:

In some Unix-like operating systems, a user must have superuser privileges to use tcpdump because the packet capturing mechanisms on those systems require elevated privileges. However, the -Z option may be used to drop privileges to a specific unprivileged user after capturing has been set up. In other Unix-like operating systems, the packet capturing mechanism can be configured to allow non-privileged users to use it; if that is done, superuser privileges are not required. http://en.wikipedia.org/wiki/Tcpdump

1

1 Answer 1

1

It is possible to capture packets without being root, but you need to have the CAP_NET_ADMIN and CAP_NET_RAW capabilities. Basically you have to become root (so that you get all of the capabilities), then drop all of your capabilities except for those two, and drop root privileges too.

For managing the user ID that UNIX commands run as there are convenient tools like sudo. Unfortunately there are no standard tools to manipulate capabilities from the shell in the way that is required here.

This page describes what you need to do at the C level and this one contains a HOWTO to set up Wireshark to work this way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .