Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message

There are no interfaces on which a capture can be done.

Where I've made a mistake?

$ groups dima
lp wheel games video audio optical storage power wireshark users
$ ls -l /usr/bin/dumpcap 
-rwxr-xr-- 1 root wireshark 77000 Jul 29 12:07 /usr/bin/dumpcap
$ getcap /usr/bin/dumpcap 
/usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip
share|improve this question
    
What does strace dumpcap -D print? – user164970 Aug 7 '13 at 7:11

You should add your user to a wireshark group, add the dumpcap to wireshark group and add permissions to dumpcap

   # chgrp wireshark /usr/bin/dumpcap
   # chmod 7450 /usr/bin/dumpcap

The path can be /usr/bin/dumpcap or /usr/sbin/dumpcap

share|improve this answer
1  
Don't you need to sudo those commands, since you're running as a user? – Canadian Luke Jan 24 '14 at 17:02
    
"You should add your user to a wireshark group". He is in that group - see the output of "groups dima", which includes "wireshark". And dumpcap does have extra privileges - see the output of "getcap /usr/bin/dumpcap". The question is whether those privileges are working; that's why I asked him to try strace dumpcap -D, to see what dumpcap is trying to do when you ask it to list devices. – user164970 Jan 24 '14 at 23:40

Try doing the capture using tcpdump at the command line, then open the resulting pcap file with Wireshark or something else. Like so:

sudo tcpdump -w test.pcap -vv -i wlan0
share|improve this answer
    
If Wireshark isn't showing any devices, dumpcap probably isn't showing any devices, which means that dumpcap probably can't open any devices, which means that there's a good chance that tcpdump can't open any devices, either. (BTW, "-v" is pointless with "-w" - "-w" means "save packets to a file rather than printing them", and "-v" means "print packets verbosely.) – user164970 Jan 24 '14 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .