Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know which security features are disabled(if any) when i start wireshark in Ubuntu 10.10.

share|improve this question

Wireshark does not start any services or open any ports, although it may perform network activity if you have it configured to resolve IP addresses to DNS names.

If you wish to avoid running Wireshark as root, you can use the following command in a terminal:

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

This gives additional privileges to the dumpcap tool, which is the back-end of Wireshark which actually performs the packet sniffing, so that the entire Wireshark application does not need to run with root privileges.

More information about Wireshark privileges on Linux is available here.

share|improve this answer
Hi, i think i asked the question in an incorrect manner. I have not reformatted my question. See,if you can help out. – Ajay Jul 11 '11 at 9:55
The answer is more or less the same — Wireshark doesn't specifically or intentionally introduce any security holes or disable any features, but the general advice not to run as root still holds in case there is a bug or exploit in the Wireshark application. – TooManyKooks Jul 11 '11 at 10:14

When I start wireshark i got a "device eth0 entered promiscuous mode". (running wireshark non-root) Wireshark has a weakness: lots of code. A gentoo dev described it as a security issue. running wireshark non-root: Alternative: run a apparmored tcpdump,it comes with an apparmor profile. Run it: tcpdump -n -i eth0 > tcpdump.txt gzip tcpdump.txt.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.