Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed wireshark (tshark) using

sudo apt-get install tshark

this installed the tshark executable in /usr/bin/tshark.

The problem now is that I am unable to run it without root permissions. How can I execute this command using the permissions of a normal user?

share|improve this question

migrated from stackoverflow.com Dec 10 '09 at 6:26

This question came from our site for professional and enthusiast programmers.

The Wireshark wiki discusses permissions and ways to "circumvent" them if needed - although I'm pretty sure that any packet capturing on Linux would require root at some level.

share|improve this answer

I had a similar issue with not being able to see any network interfaces when running Wireshark (tshark's GUI cousin) as a non-root user. Nowadays, Ubuntu and Debian support file capabilities with which I was able to get Wireshark (and tshark) running as non-root.

  1. Create a wireshark group.

    sudo groupadd wireshark  
    
  2. Add your username to the wireshark group.

    sudo usermod -a -G wireshark yourusername
    
  3. Change group ownership of dumpcap to wireshark group.

    sudo chgrp wireshark /usr/bin/dumpcap
    
  4. Set file permissions of dumpcap to 754 (rwx for user, r-x for group).

    sudo chmod 754 /usr/bin/dumpcap
    
  5. Enable file capabilities for dumpcap.

    sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
    
  6. You may also need to run dpkg-reconfigure for wireshark-common if you install Wireshark or tshark as a package through Synaptic and enable packet capture for non-root users.

    sudo dpkg-reconfigure wireshark-common
    
share|improve this answer
    
refer to the great wireshark wiki regarding capture privileges. Look at the section titled, "Limiting capture permission to only one group"... – Jun_in_Jeju Jul 3 '12 at 13:03
    
the wireshark group and the permissions will be set by dpkg-reconfigure wireshark-common – MichielB Nov 24 '15 at 19:51

It will probably need root credential to put the network card into premiscious mode. You need to set the user id http://www.zzee.com/solutions/linux-permissions.shtml#setuid or run it with sudo. Sudo is the better, more secure, option.

share|improve this answer
    
I'm not sure why you think 'sudo is the better, more secure option'. Also if you start Wireshark like that on Debian/Ubuntu, you'll get all kinds of nasty error messages. – MichielB Nov 24 '15 at 15:46

You'll need to configure wireshark to allow non-root-users to capture packets:

dpkg-reconfigure wireshark-common

Add yourself to the wireshark group:

sudo usermod -a -G wireshark "$USER"

Restart your system so the group permissions will be applied. Now you can start wireshark and capture some packets!

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .