Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is it possible to capture packets without superuser?

This is what I see in the wikipedia article:

In some Unix-like operating systems, a user must have superuser privileges to use tcpdump because the packet capturing mechanisms on those systems require elevated privileges. However, the -Z option may be used to drop privileges to a specific unprivileged user after capturing has been set up. In other Unix-like operating systems, the packet capturing mechanism can be configured to allow non-privileged users to use it; if that is done, superuser privileges are not required. http://en.wikipedia.org/wiki/Tcpdump

share|improve this question
    
I think, it better suits for sites like unix.stackexchange.com –  Anwar Shah Sep 2 '12 at 18:31

1 Answer 1

up vote 1 down vote accepted

It is possible to capture packets without being root, but you need to have the CAP_NET_ADMIN and CAP_NET_RAW capabilities. Basically you have to become root (so that you get all of the capabilities), then drop all of your capabilities except for those two, and drop root privileges too.

For managing the user ID that UNIX commands run as there are convenient tools like sudo. Unfortunately there are no standard tools to manipulate capabilities from the shell in the way that is required here.

This page describes what you need to do at the C level and this one contains a HOWTO to set up Wireshark to work this way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.