47

I installed Wireshark. Running as root is not recommended, so

I Did

sudo dpkg-reconfigure wireshark-common

According to:

http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

http://anonscm.debian.org/viewvc/collab-maint/ext-maint/wireshark/trunk/debian/README.Debian?view=markup

Answered Yes, Logout out Started Wireshark and got this message:

couldn't run /usr/bin/dumpcap in child process: Permission Denied.

I think I followed the recommended way of configuring Wireshark, it worked in 13.10, it doesn't in 14.04

FYI, reconfiguring wireshark-common is actually setting the group for dumpcap to Wireshark. Still it doesn't work. I checked that.

How should it be done in 14.04?

  • I guess you've already checked that you, the user, are in the wireshark group – Akronix May 1 '14 at 9:03
  • Yes. that said, I stumble on this groups $USER does list wireshark groups $user does NOT list wireshark – Janghou May 1 '14 at 9:14
  • 1
    possible duplicate of How do I run wireshark, with root-privileges? – Eric Carvalho Apr 8 '15 at 12:41
  • 1
    Simply run this: sudo usermod -aG wireshark $USER. Then, log out and back in again. – l3x Nov 8 '18 at 20:46
70

I found that after running:

sudo dpkg-reconfigure wireshark-common

a wireshark group been created in /etc/gshadow. So I just wrote:

sudo gpasswd -a $USER wireshark

and logout/login and now it works fine!

  • Three cheers. This should be marked as the solution but OP probably abandoned the thread. – Hack-R Aug 20 '17 at 15:27
  • 2
    Instead of logout/login, just type newgrp wireshark as your normal user, it is faster, and works the same in my experience with 18.04. – Nicolas Raoul May 28 '18 at 7:27
  • Yeah it works, can you please explain above commands in detail, or can provide any link? – Abhay Sehgal May 5 at 11:50
21

Yes, you did correct. But some thing is missing.If you see the error message like couldn't run /usr/bin/dumpcap in child process: Permission Denied.Go to terminal and

sudo dpkg-reconfigure wireshark-common

choose answer as "YES" .Then add user to the group by

sudo adduser $USER wireshark

Then restart your machine and open wireshark. It works.

  • 4
    You don't have to restart. Logging out/in would do. – heemayl Jun 29 '16 at 3:08
  • 1
    Don't forget to add the "-a" parameter to the adduser command. -a, --add USER add USER to GROUP – Thanos Oct 19 '16 at 12:48
  • 2
    I had to restart - login/out did not work (ubuntu 16.10-64bit) – TmTron Feb 27 '17 at 17:36
  • Yeah it works, can you please explain above commands in detail, or can provide any link? – Abhay Sehgal May 5 at 11:50
2
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

Check this question

  • Now I can see all the Interfaces, but the error messages still showing up when the program is starting. – Francisco Corrales Morales May 24 '16 at 4:45

protected by Community Jun 30 '16 at 17:10

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.