wireshark config/packet socket support

Question

Day Three of using Ubuntu and yet another question.

Today I installed Wireshark. Upon starting for the first time, I am told that "No interface can be used for capturing in this system with the current configuration"

below that is "Capture Help" followed by "HOW TO CAPTURE - A step by step guide to a successful capture set up" Guide is as follows:

How To Set Up a Capture

Step 1: Are you allowed to do this?

Step 2: General Setup

Step 3: Capture traffic "sent to" and "sent from" your local machine

Step 4: Capture traffic destined for machines other than your own

Step 5: Capture traffic using a remote machine

Step 1, ok ! Step 2 is where i am stuck...

You will need to make sure the machine on which you're running is configured to support packet capture, e.g. you might need a capture driver installed. The way this is done differs from operating system to operating system."

Linux

On Linux, you need to have "packet socket" support enabled in your kernel; see the "Packet socket" item in the Linux "Configure.help" file. Your distribution might enable this by default in the kernel."

Could somebody please tell me how I go about having packet socket support enabled please ?

Many thanks in anticipation

Answer 1

The "No interface can be used for capturing in this system with the current configuration" message commonly appears when you don't have the privileges to access the network interfaces for monitoring. Try opening a terminal and running gksudo wireshark. If several network interfaces appear, it's because when you run wireshark without root permissions you don't have the privileges to monitor.

To fix that, run the following command in a terminal:

sudo setcap CAP_NET_RAW,CAP_NET_ADMIN,CAP_DAC_OVERRIDE+eip /usr/bin/dumpcap

a little explanation is available on this other AskUbuntu question

Answer 2

Step 2, these days, should list the CapturePrivileges page before the CaptureSupport page, as most OSes have capture support built in by default, so the problem is more likely to be a privileges problem (as jackweirdy notes) than an "OS needs to be rebuilt or reconfigured to support packet capture" problem.

This includes most if not all Linux distributions; the kernel is almost always, if not always, built with packet socket support these days. That's the case on all my Ubuntu virtual machines (7.10, 9.10, 10.10, and 12.04), and it's also the case for your system.

Follow jackwierdy's advice here; your problem is almost certainly a privileges problem.

(I've just now updated the Wireshark Wiki's CaptureSetup page, so that it lists the CapturePrivileges page before the CaptureSupport page, to encourage people to check the CapturePrivileges page rather than the CaptureSupport page; the latter page is the one from which you were quoting.)