54

I installed Wireshark. Running as root is not recommended, so

I Did

sudo dpkg-reconfigure wireshark-common

According to:

http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

http://anonscm.debian.org/viewvc/collab-maint/ext-maint/wireshark/trunk/debian/README.Debian?view=markup

Answered Yes, Logout out Started Wireshark and got this message:

couldn't run /usr/bin/dumpcap in child process: Permission Denied.

I think I followed the recommended way of configuring Wireshark, it worked in 13.10, it doesn't in 14.04

FYI, reconfiguring wireshark-common is actually setting the group for dumpcap to Wireshark. Still it doesn't work. I checked that.

How should it be done in 14.04?

  • I guess you've already checked that you, the user, are in the wireshark group – Akronix May 1 '14 at 9:03
  • Yes. that said, I stumble on this groups $USER does list wireshark groups $user does NOT list wireshark – Janghou May 1 '14 at 9:14
  • 1
    possible duplicate of How do I run wireshark, with root-privileges? – Eric Carvalho Apr 8 '15 at 12:41
  • 1
    Simply run this: sudo usermod -aG wireshark $USER. Then, log out and back in again. – l3x Nov 8 '18 at 20:46
79

I found that after running:

sudo dpkg-reconfigure wireshark-common

a wireshark group been created in /etc/gshadow. So I just wrote:

sudo gpasswd -a $USER wireshark

and logout/login and now it works fine!

| improve this answer | |
  • Three cheers. This should be marked as the solution but OP probably abandoned the thread. – Hack-R Aug 20 '17 at 15:27
  • 2
    Instead of logout/login, just type newgrp wireshark as your normal user, it is faster, and works the same in my experience with 18.04. – Nicolas Raoul May 28 '18 at 7:27
  • Yeah it works, can you please explain above commands in detail, or can provide any link? – Abhay Sehgal May 5 '19 at 11:50
  • Works 101% Thanks! – Detained Developer Jan 22 at 16:55
26

Yes, you did correct. But some thing is missing.If you see the error message like couldn't run /usr/bin/dumpcap in child process: Permission Denied.Go to terminal and

sudo dpkg-reconfigure wireshark-common

choose answer as "YES" .Then add user to the group by

sudo adduser $USER wireshark

Then restart your machine and open wireshark. It works.

| improve this answer | |
  • 4
    You don't have to restart. Logging out/in would do. – heemayl Jun 29 '16 at 3:08
  • 1
    Don't forget to add the "-a" parameter to the adduser command. -a, --add USER add USER to GROUP – Thanos Oct 19 '16 at 12:48
  • 2
    I had to restart - login/out did not work (ubuntu 16.10-64bit) – TmTron Feb 27 '17 at 17:36
  • Yeah it works, can you please explain above commands in detail, or can provide any link? – Abhay Sehgal May 5 '19 at 11:50
2
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

Check this question

| improve this answer | |
  • Now I can see all the Interfaces, but the error messages still showing up when the program is starting. – Francisco Corrales Morales May 24 '16 at 4:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.