Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have libpcap set up with the newest cvs version. Regular users can run Wireshark and tshark. Specifically, they have been added to the wireshark group and can capture from

1. eth0
2. br0
3. nflog (Linux netfilter log (NFLOG) interface)
4. nfqueue (Linux netfilter queue (NFQUEUE) interface)
5. any (Pseudo-device that captures on all interfaces)
6. lo

Unfortunately, they don't see the usbmon devices that root does:

1. eth0
2. br0
3. nflog (Linux netfilter log (NFLOG) interface)
4. nfqueue (Linux netfilter queue (NFQUEUE) interface)
5. usbmon1 (USB bus number 1)
6. usbmon2 (USB bus number 2)
7. usbmon3 (USB bus number 3)
8. usbmon4 (USB bus number 4)
9. usbmon5 (USB bus number 5)
10. usbmon6 (USB bus number 6)
11. usbmon7 (USB bus number 7)
12. any (Pseudo-device that captures on all interfaces)
13. lo

As root, tshark -D lists all the usbmon devices. However, the regular user cannot see the usbmon devices with either wireshark or tshark.

How can I make the usbmon devices availaible to wireshark group users?

share|improve this question
up vote 4 down vote accepted

I found the answer here.

To enable wireshark users (those added to the wireshark group) to capture USB data, permissions for usbmon have to be changed:

chmod o=rw /dev/usbmon*

Another answer for almost the same question (with an alternative answer) is here.

share|improve this answer

I solved this by creating a group for the users which should be able to use usbmon and then let udev change the ownership of the device. So just create a group, add your user to the group and place a udev rule into "/etc/udev/rules.d":

addgroup usbmon
gpasswd -a $USER usbmon
echo 'SUBSYSTEM=="usbmon", GROUP="usbmon", MODE="640"' > /etc/udev/rules.d/99-usbmon.rules

And last but not least either reboot or make sure that the user actually is in the group and trigger udev or rmmod and modprobe again.

share|improve this answer
Made it a Ansible role: udev-usbmon – ypid Jan 31 '15 at 16:39
Thank you. I have been looking for the udev solution for a while now. – FazJaxton Jul 9 '15 at 0:46


You need to run Wireshark or TShark on an account with sufficient privileges to capture, or need to give the account on which you're running Wireshark or TShark sufficient privileges to capture.

share|improve this answer
The account has sufficient privileges to capture - just not usbmon apparently. – Donnied Jul 14 '13 at 12:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.