Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I installed wireshark (tshark) using

sudo apt-get install tshark

this installed the tshark executable in /usr/bin/tshark.

The problem now is that I am unable to run it without root permissions. How can I execute this command using the permissions of a normal user?

share|improve this question

migrated from Dec 10 '09 at 6:26

This question came from our site for professional and enthusiast programmers.

4 Answers 4

The Wireshark wiki discusses permissions and ways to "circumvent" them if needed - although I'm pretty sure that any packet capturing on Linux would require root at some level.

share|improve this answer

I had a similar issue with not being able to see any network interfaces when running Wireshark (tshark's GUI cousin) as a non-root user. Nowadays, Ubuntu and Debian support file capabilities with which I was able to get Wireshark (and tshark) running as non-root.

  1. Create a wireshark group.

    sudo groupadd wireshark  
  2. Add your username to the wireshark group.

    sudo usermod -a -G wireshark yourusername
  3. Change group ownership of dumpcap to wireshark group.

    sudo chgrp wireshark /usr/bin/dumpcap
  4. Set file permissions of dumpcap to 754 (rwx for user, r-x for group).

    sudo chmod 754 /usr/bin/dumpcap
  5. Enable file capabilities for dumpcap.

    sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
  6. You may also need to run dpkg-reconfigure for wireshark-common if you install Wireshark or tshark as a package through Synaptic and enable packet capture for non-root users.

    sudo dpkg-reconfigure wireshark-common
share|improve this answer
refer to the great wireshark wiki regarding capture privileges. Look at the section titled, "Limiting capture permission to only one group"... – Jun_in_Jeju Jul 3 '12 at 13:03
the wireshark group and the permissions will be set by dpkg-reconfigure wireshark-common – MichielB yesterday

It will probably need root credential to put the network card into premiscious mode. You need to set the user id or run it with sudo. Sudo is the better, more secure, option.

share|improve this answer
I'm not sure why you think 'sudo is the better, more secure option'. Also if you start Wireshark like that on Debian/Ubuntu, you'll get all kinds of nasty error messages. – MichielB yesterday

You'll need to configure wireshark to allow non-root-users to capture packets:

dpkg-reconfigure wireshark-common

Add yourself to the wireshark group:

sudo usermod -a -G wireshark "$USER"

Restart your system so the group permissions will be applied. Now you can start wireshark and capture some packets!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.