Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I started WireShark on my Ubuntu machine and discovered that there were no interfaces I could listen to. So I launched it as root. This gave me access to all the interfaces, but gave me a warning:

Running WireShark as user 'root' in group 'root'. This could be dangerous...

So, is it dangerous? Otherwise, how can I listen to the interfaces?

share|improve this question

4 Answers 4

up vote 4 down vote accepted

Wireshark is quickly approaching two million lines of code. You shouldn't run them as root for the same reasons that you shouldn't run Firefox, OpenOffice, GIMP, or any other similarly-sized application as root.

On Linux you don't need to be root to capture packets. You just need the CAP_NET_ADMIN and CAP_NET_RAW privileges. On most distributions this is easy to get up and running. Ubuntu doesn't do this by default yet, but it hopefully will at some point in the future.

share|improve this answer

according to http://wiki.wireshark.org/CaptureSetup/CapturePrivileges you should not run it as root.

Instead, use root privileges to dump using dumpcap or tcpdump and then analyse using wireshark.

share|improve this answer
    
Ah... but can harm come of using root privileges? –  Nathan Osman May 9 '10 at 5:34
2  
In general, yes/no. Better not to use root where you can get by without it. But if this is just your home machine and you're not going to bring down your office network/servers, fire away. In relation to wireshark, I think you'll be safe enough. –  bryan May 9 '10 at 5:55
2  
unless someone on your network is spewing packets specially crafted to exploit bugs in wireshark; then, using it as root is bad, bad news. –  Charles Duffy May 9 '10 at 8:18

Wireshark has a long history of security bugs in the disectors (the plugins which describe how to interpret various over-the-wire protocols). For that reason, it's safer to perform your captures with a simpler tool such as tcpdump, then use wireshark to interpret them as an unprivileged user.

share|improve this answer

It depends on what's on your machine really. Do you use a spare laptop just for sniffing? Then run as root. If you have important data on that machine then run tcpdump from the cli and use wireshark to analyze the traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.