18

I am setting up wireshark to run as non root user, a la here, that is:

sudo apt-get install wireshark
sudo dpkg-reconfigure wireshark-common 
sudo usermod -a -G wireshark $USER
(restart)

This is all great. But when I try to start wireshark as the wireshark user, using:

sudo -s -u $USER wireshark

I get the following error:

no protocol specified
gtk-warning ** cannot open display

The "no protocol specified" part seems pretty straight forward. And the gtk-warning cannot open display seems to relate exactly to this issue.

"You have two ways to get this working: grant it or have root take it. You (greg) can grant it by means of 'xhost local:root'. Or root can take it, because it can access your files: 'export AUTHORITY=/home/greg/.Xauthority'."

This doesn't make sense to me. What was the point in granting access to the other user if they can't open the program anyway? This separating is done for security reasons, so isn't making that above modification reverting the earlier comment

"This has to do with access control to your X server. You don't want just anybody opening windows on your screen, do you. So if you started the X server under your own account (greg) then any other user (like root) doesn't have access to it."

TLDR; Is this standard practice and the way this should be done, to achieve separation between root and other user account? It seems like a "hack" to me.

1

3 Answers 3

12

$USER is here to see as a shell variable. The third command above adds your user to the wireshark group and should be replaced by sudo adduser <yourUser> wireshark.
Now you should be able to invoke wireshark as yourself (no need to sudo anymore).

As has been pointed out by Guerlando Ocs you may encounter a situation where the group wireshark doesn't exist. In this case you can resolve the problem by first running

sudo dpkg-reconfigure wireshark-common 

and selecting yes so it creates the group for non root users.

2
  • 1
    If there's no wireshark group as in my case, run sudo dpkg-reconfigure wireshark-common and select yes so it creates the group for non root users Jun 21, 2021 at 3:29
  • @GuerlandoOCs thank you for the observation and solution! I edited it into the answer.
    – guntbert
    Jun 22, 2021 at 21:30
6

This is how I installed Wireshark and made it work, running it as non-root user:

Install Wireshark:

sudo apt-get update
sudo add-apt-repository ppa:dreibh/ppa
sudo apt-get update
sudo apt-get install wireshark

Enable it to run as non-root user:

sudo dpkg-reconfigure wireshark-common
sudo adduser <yourUser> wireshark
sudo chmod +x /usr/bin/dumpcap
4
  • 2
    Why do you suggest to use a ppa? Wireshark is available in the standard repository.
    – guntbert
    Sep 16, 2018 at 9:24
  • 4
    sudo chmod +x /usr/bin/dumpcap did the trick Dec 10, 2020 at 7:30
  • 2
    Attention people: NEVER install things from random ppas from the internet. It's just a repository compiled by anyone. And this is very dangerous Jun 21, 2021 at 3:23
  • 1
    sudo chmod +x /usr/bin/dumpcap can be avoided by restarting the system after adding the user to the wireshark group. May 23, 2023 at 11:51
0

Install Wireshark

There are mainly two PPA provided By Wireshark Developer team 1. Stable release 2. Nightly Release ( Link to Wireshark Developers official stable/Nightly PPA )

  1. Using Wireshark Developers Stable release (Up to Ubuntu Bionic)

    sudo add-apt-repository ppa:wireshark-dev/stable -y
    sudo apt update
    sudo apt install wireshark
    sudo dpkg-reconfigure wireshark-common
    sudo adduser $USER wireshark
    sudo chmod +x /usr/bin/dumpcap
    
  2. Using Wireshark Developers Nightly Release (supported upto ubuntu xenial)

    sudo add-apt-repository ppa:wireshark-dev/nightly
    sudo apt update
    sudo apt install wireshark
    sudo dpkg-reconfigure wireshark-common
    sudo adduser $USER wireshark
    sudo chmod +x /usr/bin/dumpcap
    

Don't forget logout the current user and re-login ( adding user group )

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .