54

I installed Wireshark. Running as root is not recommended, so

I Did

sudo dpkg-reconfigure wireshark-common

According to:

http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

http://anonscm.debian.org/viewvc/collab-maint/ext-maint/wireshark/trunk/debian/README.Debian?view=markup

Answered Yes, Logout out Started Wireshark and got this message:

couldn't run /usr/bin/dumpcap in child process: Permission Denied.

I think I followed the recommended way of configuring Wireshark, it worked in 13.10, it doesn't in 14.04

FYI, reconfiguring wireshark-common is actually setting the group for dumpcap to Wireshark. Still it doesn't work. I checked that.

How should it be done in 14.04?

4
  • I guess you've already checked that you, the user, are in the wireshark group
    – Akronix
    May 1, 2014 at 9:03
  • Yes. that said, I stumble on this groups $USER does list wireshark groups $user does NOT list wireshark
    – Janghou
    May 1, 2014 at 9:14
  • 1
    possible duplicate of How do I run wireshark, with root-privileges? Apr 8, 2015 at 12:41
  • 1
    Simply run this: sudo usermod -aG wireshark $USER. Then, log out and back in again.
    – l3x
    Nov 8, 2018 at 20:46

3 Answers 3

81

I found that after running:

sudo dpkg-reconfigure wireshark-common

a wireshark group been created in /etc/gshadow. So I just wrote:

sudo gpasswd -a $USER wireshark

and logout/login and now it works fine!

4
  • Three cheers. This should be marked as the solution but OP probably abandoned the thread.
    – Hack-R
    Aug 20, 2017 at 15:27
  • 2
    Instead of logout/login, just type newgrp wireshark as your normal user, it is faster, and works the same in my experience with 18.04. May 28, 2018 at 7:27
  • Yeah it works, can you please explain above commands in detail, or can provide any link? May 5, 2019 at 11:50
  • Works 101% Thanks! Jan 22, 2020 at 16:55
26

Yes, you did correct. But some thing is missing.If you see the error message like couldn't run /usr/bin/dumpcap in child process: Permission Denied.Go to terminal and

sudo dpkg-reconfigure wireshark-common

choose answer as "YES" .Then add user to the group by

sudo adduser $USER wireshark

Then restart your machine and open wireshark. It works.

4
  • 4
    You don't have to restart. Logging out/in would do.
    – heemayl
    Jun 29, 2016 at 3:08
  • 1
    Don't forget to add the "-a" parameter to the adduser command. -a, --add USER add USER to GROUP
    – Thanos
    Oct 19, 2016 at 12:48
  • 2
    I had to restart - login/out did not work (ubuntu 16.10-64bit)
    – TmTron
    Feb 27, 2017 at 17:36
  • Yeah it works, can you please explain above commands in detail, or can provide any link? May 5, 2019 at 11:50
3
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

Check this question

1
  • Now I can see all the Interfaces, but the error messages still showing up when the program is starting. May 24, 2016 at 4:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .