Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.


I want to know which security features are disabled(if any) when i start wireshark in Ubuntu 10.10.

share|improve this question

2 Answers 2

Wireshark does not start any services or open any ports, although it may perform network activity if you have it configured to resolve IP addresses to DNS names.

If you wish to avoid running Wireshark as root, you can use the following command in a terminal:

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

This gives additional privileges to the dumpcap tool, which is the back-end of Wireshark which actually performs the packet sniffing, so that the entire Wireshark application does not need to run with root privileges.

More information about Wireshark privileges on Linux is available here.

share|improve this answer
    
Hi, i think i asked the question in an incorrect manner. I have not reformatted my question. See,if you can help out. –  Ajay Jul 11 '11 at 9:55
    
The answer is more or less the same — Wireshark doesn't specifically or intentionally introduce any security holes or disable any features, but the general advice not to run as root still holds in case there is a bug or exploit in the Wireshark application. –  OrbWeaver Jul 11 '11 at 10:14

When I start wireshark i got a "device eth0 entered promiscuous mode". (running wireshark non-root) Wireshark has a weakness: lots of code. A gentoo dev described it as a security issue. running wireshark non-root: http://ubuntuforums.org/showthread.php?t=1420930 Alternative: run a apparmored tcpdump,it comes with an apparmor profile. Run it: tcpdump -n -i eth0 > tcpdump.txt gzip tcpdump.txt.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.