2

Day Three of using Ubuntu and yet another question.

Today I installed Wireshark. Upon starting for the first time, I am told that "No interface can be used for capturing in this system with the current configuration"

below that is "Capture Help" followed by "HOW TO CAPTURE - A step by step guide to a successful capture set up" Guide is as follows:

How To Set Up a Capture

Step 1: Are you allowed to do this?

Step 2: General Setup

Step 3: Capture traffic "sent to" and "sent from" your local machine

Step 4: Capture traffic destined for machines other than your own

Step 5: Capture traffic using a remote machine

Step 1, ok ! Step 2 is where i am stuck...

You will need to make sure the machine on which you're running is configured to support packet capture, e.g. you might need a capture driver installed. The way this is done differs from operating system to operating system."

Linux

On Linux, you need to have "packet socket" support enabled in your kernel; see the "Packet socket" item in the Linux "Configure.help" file. Your distribution might enable this by default in the kernel."

Could somebody please tell me how I go about having packet socket support enabled please ?

Many thanks in anticipation

4

The "No interface can be used for capturing in this system with the current configuration" message commonly appears when you don't have the privileges to access the network interfaces for monitoring. Try opening a terminal and running gksudo wireshark. If several network interfaces appear, it's because when you run wireshark without root permissions you don't have the privileges to monitor.

To fix that, run the following command in a terminal:

sudo setcap CAP_NET_RAW,CAP_NET_ADMIN,CAP_DAC_OVERRIDE+eip /usr/bin/dumpcap

a little explanation is available on this other AskUbuntu question

  • thats perfect thank you jackweirdy thank you very much – daniel hearn Jun 5 '13 at 19:17
  • so gksudo before any program name opens that program with root privs? – daniel hearn Jun 5 '13 at 19:19
  • gksudo before any graphical program; use sudo for command line programs :) – jackweirdy Jun 5 '13 at 19:22
1

Step 2, these days, should list the CapturePrivileges page before the CaptureSupport page, as most OSes have capture support built in by default, so the problem is more likely to be a privileges problem (as jackweirdy notes) than an "OS needs to be rebuilt or reconfigured to support packet capture" problem.

This includes most if not all Linux distributions; the kernel is almost always, if not always, built with packet socket support these days. That's the case on all my Ubuntu virtual machines (7.10, 9.10, 10.10, and 12.04), and it's also the case for your system.

Follow jackwierdy's advice here; your problem is almost certainly a privileges problem.

(I've just now updated the Wireshark Wiki's CaptureSetup page, so that it lists the CapturePrivileges page before the CaptureSupport page, to encourage people to check the CapturePrivileges page rather than the CaptureSupport page; the latter page is the one from which you were quoting.)

  • you are a star thank you ! I did wonder if it was built in, the pages I quoted from did mention that it could be but i wanted to check thanks again guy :) – daniel hearn Jun 5 '13 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.