29

I'm using Ubuntu 13.04.

Wireshark won't show me any logs, won't function at all. I'm connected to my WiFi, Belkin router.

2
  • A quick workaround, not a solution: You can run wireshark as root: gksudo wireshark.
    – soulsource
    Sep 22, 2013 at 13:55
  • sudo chown -R $LOGNAME /usr/bin/dumpcap resolves by changing the ownership from root to current.
    – parasrish
    May 19, 2022 at 15:22

5 Answers 5

62

Open a terminal by pressing Ctrl+Alt+T and type the following commands:

sudo dpkg-reconfigure wireshark-common

press the right arrow and enter for yes

sudo chmod +x /usr/bin/dumpcap

you should now be able to run it without root and you will be able to capture.

4
  • 4
    +1. It works on 14.04 too. Note: the docs say: "capturing USB packets is not enabled for non-root users by using Linux Capabilities. You have to capture the packets using the method described in I./a., setting the set-user-id permanently using dpkg-statoverride or running Wireshark as root."
    – jfs
    Sep 19, 2014 at 9:16
  • It would be great help for newbies, if you can also describe as to what's being done with above commands that make it work
    – Ahmed
    Mar 28, 2015 at 12:38
  • 1
    IT WORKS on LTS 14.04.... Thank you so much.
    – ThN
    May 1, 2015 at 5:19
  • chmod +x makes dumpcap executable to everyone. An alternative would be to add users you want to permit capture into wireshark group.
    – domen
    May 2, 2019 at 7:56
2

The "No interface can be used for capturing in this system with the current configuration" message commonly appears when you don't have the privileges to access the network interfaces for monitoring. Try opening a terminal and running gksudo wireshark. If several network interfaces appear, it's because when you run wireshark without root permissions you don't have the privileges to monitor.

To fix that, run the following command in a terminal:

sudo setcap CAP_NET_RAW,CAP_NET_ADMIN,CAP_DAC_OVERRIDE+eip /usr/bin/dumpcap
1
  • "Try opening a terminal and running gksudo wireshark." Please note that this document says "WIRESHARK CONTAINS OVER TWO MILLION LINES OF SOURCE CODE. DO NOT RUN THEM AS ROOT." before doing that. Do the sudo setcap command instead - or use sudo dpkg-reconfigure wireshark-common to have the package set the capabilities for you.
    – user126192
    Feb 18, 2014 at 20:04
1

When I tried to run wireshark I was getting this error:

Couldn't run /usr/bin/dumpcap in child process: Permission denied

so I used to run it as root, which disabled LUA. The pop-up window informing me that the LUA has been disabled was so annoying, that I tried to fix it.

first off I checked privileges by running

ls -l /usr/bin/dumpcap

which resulted in :

-rwxr-xr-- 1 root wireshark 96464 Jan 24 10:31 /usr/bin/dumpcap

this was obvious, that's what Wireshark has been telling me. So I just changed the owner from root to my acc

sudo chown -R $LOGNAME /usr/bin/dumpcap

Which worked, I can now run wireshark without root

0

Googled “couldn't run /usr/bin/dumpcap in child process” and found this question:

I'm not able to use wireshark "couldn't run /usr/bin/dumpcap in child process"

Which is marked as duplicate and brought me here. The proposed solution is:

sudo chmod +x /usr/bin/dumpcap

The above command really works, but I would like to add a security WARNING. That will allow packet capture for ALL USERS on the system. It can be a temporary solution, but not desired as permanent solution.

I followed the instructions from wireshark page about about capture privileges:

https://wiki.wireshark.org/CaptureSetup/CapturePrivileges

They RECOMMEND restrict dumpcap execution to a specific group or user.

I followed those instructions (with adaptations):

Setting network privileges for dumpcap if your kernel and file system support file capabilities

  • Ensure that you have installed the necessary tools, such as the setcap command.

    sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

(NOTE: Replace /usr/bin with /usr/sbin in case you receive an error that indicates that dumpcap isn't in /usr/bin)

  • Start Wireshark as non-root and ensure you see the list of interfaces and can do live capture. (I IGNORED THIS INSTRUCTION. DID NOT WORK FOR ME)

Setting network privileges for dumpcap if your kernel and file system don't support file capabilities

In this case, you will need to make dumpcap set-UID to root.

sudo chown root /usr/bin/dumpcap 

(NOTE: Replace /usr/bin with /usr/sbin in this command and the next command in case you receive an error that indicates that dumpcap isn't in /usr/sbin)

sudo chmod u+s /usr/bin/dumpcap

Limiting capture permission to only one group

After having set dumpcap's network privileges:

  • Create user "wireshark" in group "wireshark".

    sudo chgrp wireshark /usr/sbin/dumpcap

    sudo chmod o-rx /usr/sbin/dumpcap

  • Ensure Wireshark works only from root and from a user in the "wireshark" group (I DID THIS STEP ONLY IN THE END - NOT OVER YET)

And finally, two more steps:

sudo dpkg-reconfigure wireshark-common

Choose 'yes'.

Log out ALL interfaces for the user (including ssh which was my biggest mistake) and log in again.

Hopefully, you should start wireshark and see all the interfaces as a regular user (not using sudo)

wireshark &

And if you check the file permissions

ls -la /usr/bin/dumpcap

It allows ONLY the USER and the GROUP to execute

-rwxr-xr-- 1 root wireshark

0

On Ubuntu 20.04, I followed the instructions displayed when I tried and failed to start capture.

On my first attempt I didn't read the entire message and missed the final step: log out & login again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .