16

By running wireshark in 14.04 I got this error What should I do to solve this?

Lua: Error during loading: [string "/usr/share/wireshark/init.lua"]:46: dofile has been disabled due to running Wireshark as superuser. See http://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running Wireshark as an unprivileged user.

5 Answers 5

13

That is because (I presume) you are running wireshark as root

From the link you were given in the message:

You need to run Wireshark or TShark on an account with sufficient privileges to capture, or need to give the account on which you're running Wireshark or TShark sufficient privileges to capture. The way this is done differs from operating system to operating system.

To be secure (at least in a way), it is recommended that even an administrator should always run in an account with (limited) user privileges, and only start processes that really need the administrator privileges. The Security page provides explanations why this is a good idea.

Setting network privileges for dumpcap

  1. Ensure your linux kernel and filesystem supports File Capabilities and also you have installed necessary tools.

  2. "setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap"

  3. Start Wireshark as non-root and ensure you see the list of interfaces and can do live capture.

so ...

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

don't forget to add the user to the wireshark group

sudo usermod -aG wireshark $USER

and (!) logo-off and log-on again. Then run wireshark as a non-root user.

4
  • Yes, I run that with sudo. Apr 24, 2014 at 20:15
  • I wrote this : sudo "setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap" and I got this : sudo: setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap: command not found Apr 25, 2014 at 19:35
  • 1
    try sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
    – Panther
    Apr 25, 2014 at 19:40
  • There is some documentation in the folder: /usr/share/doc/wireshark-common/ in a readme file. It goes on about some other non-root options, and dependencies for other tasks you may wish to complete.
    – j0h
    May 9, 2015 at 3:24
2

I found a simple fix for this.

  1. Go to usr/share/wireshark.
  2. Open init.lua with a text editor.
  3. Change disable_lua = false to disable_lua = true.
0
1

That is because you didn't add user to wireshark group, So:

sudo dpkg-reconfigure wireshark-common

Say YES to the message box.This adds a wireshark group.Then add user to the group by typing

sudo adduser $USER wireshark

Then restart your machine and open wireshark.

Run

wireshark

and it works good luck ;)

by @Thusitha Sumanadasa

0

I am using Mint (based on Ubuntu), in my case, it's the location of the output file caused the issue, when I change the output file to under /tmp/, then the issue is solved.

e.g

  • tshark -i wlp7s0 -w /tmp/a.pcap
0

Run the following command to open /usr/share/wireshark/init.lua in a text editor:

nano /usr/share/wireshark/init.lua

There you'll see a line similar to this:

 enable_lua = true     

Make it look like

 enable_lua = false

Press Ctrl + X to save and exit.

Wireshark is ready to use!

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .