Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I installed wireshark (tshark) using

sudo apt-get install tshark

this installed the tshark executable in /usr/bin/tshark.

The problem now is that I am unable to run it without root permissions. How can I execute this command using the permissions of a normal user?

share|improve this question

migrated from stackoverflow.com Dec 10 '09 at 6:26

This question came from our site for professional and enthusiast programmers.

3 Answers 3

The Wireshark wiki discusses permissions and ways to "circumvent" them if needed - although I'm pretty sure that any packet capturing on Linux would require root at some level.

share|improve this answer

I had a similar issue with not being able to see any network interfaces when running Wireshark (tshark's GUI cousin) as a non-root user. Nowadays, Ubuntu and Debian support file capabilities with which I was able to get Wireshark (and tshark) running as non-root.

First, create a wireshark group

:~$ sudo groupadd wireshark

Second, add your username to the wireshark group

:~$ sudo usermod -a -G wireshark yourusername

Third, change group ownership of dumpcap to wireshark group

:~$ sudo chgrp wireshark /usr/bin/dumpcap

Fourth, set file permissions of dumpcap to 754 (rwx for user, r-x for group)

:~$ sudo chmod 754 /usr/bin/dumpcap

Fifth, enable file capabilities for dumpcap

:~$ sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

You may also need to run dpkg-reconfigure for wireshark-common if you install wireshark or tshark as a package through Synaptic and enable packet capture for non-root users

:~$ sudo dpkg-reconfigure wireshark-common
share|improve this answer
    
refer to the great wireshark wiki regarding capture privileges. Look at the section titled, "Limiting capture permission to only one group"... –  Jun_in_Jeju Jul 3 '12 at 13:03

It will probably need root credential to put the network card into premiscious mode. You need to set the user id http://www.zzee.com/solutions/linux-permissions.shtml#setuid or run it with sudo. Sudo is the better, more secure, option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.