I want to know which security features are disabled(if any) when i start wireshark in Ubuntu 10.10.
Wireshark does not start any services or open any ports, although it may perform network activity if you have it configured to resolve IP addresses to DNS names.
If you wish to avoid running Wireshark as root, you can use the following command in a terminal:
This gives additional privileges to the
More information about Wireshark privileges on Linux is available here.
When I start wireshark i got a "device eth0 entered promiscuous mode". (running wireshark non-root) Wireshark has a weakness: lots of code. A gentoo dev described it as a security issue. running wireshark non-root: http://ubuntuforums.org/showthread.php?t=1420930 Alternative: run a apparmored tcpdump,it comes with an apparmor profile. Run it: tcpdump -n -i eth0 > tcpdump.txt gzip tcpdump.txt.