0

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message

There are no interfaces on which a capture can be done.

Where I've made a mistake?

$ groups dima
lp wheel games video audio optical storage power wireshark users
$ ls -l /usr/bin/dumpcap 
-rwxr-xr-- 1 root wireshark 77000 Jul 29 12:07 /usr/bin/dumpcap
$ getcap /usr/bin/dumpcap 
/usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip
Improve this question
1
  • What does strace dumpcap -D print?
    – user164970
    Aug 7, 2013 at 7:11

2 Answers 2

Reset to default
1

You should add your user to a wireshark group, add the dumpcap to wireshark group and add permissions to dumpcap

   # chgrp wireshark /usr/bin/dumpcap
   # chmod 7450 /usr/bin/dumpcap

The path can be /usr/bin/dumpcap or /usr/sbin/dumpcap

Improve this answer
2
  • 1
    Don't you need to sudo those commands, since you're running as a user?
    – Canadian Luke
    Jan 24, 2014 at 17:02
  • "You should add your user to a wireshark group". He is in that group - see the output of "groups dima", which includes "wireshark". And dumpcap does have extra privileges - see the output of "getcap /usr/bin/dumpcap". The question is whether those privileges are working; that's why I asked him to try strace dumpcap -D, to see what dumpcap is trying to do when you ask it to list devices.
    – user164970
    Jan 24, 2014 at 23:40
0

Try doing the capture using tcpdump at the command line, then open the resulting pcap file with Wireshark or something else. Like so:

sudo tcpdump -w test.pcap -vv -i wlan0
Improve this answer
1
  • If Wireshark isn't showing any devices, dumpcap probably isn't showing any devices, which means that dumpcap probably can't open any devices, which means that there's a good chance that tcpdump can't open any devices, either. (BTW, "-v" is pointless with "-w" - "-w" means "save packets to a file rather than printing them", and "-v" means "print packets verbosely.)
    – user164970
    Jan 24, 2014 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .