I started WireShark on my Ubuntu machine and discovered that there were no interfaces I could listen to. So I launched it as root. This gave me access to all the interfaces, but gave me a warning:

Running WireShark as user 'root' in group 'root'. This could be dangerous...

So, is it dangerous? Otherwise, how can I listen to the interfaces?


Wireshark is quickly approaching two million lines of code. You shouldn't run them as root for the same reasons that you shouldn't run Firefox, OpenOffice, GIMP, or any other similarly-sized application as root.

On Linux you don't need to be root to capture packets. You just need the CAP_NET_ADMIN and CAP_NET_RAW privileges. On most distributions this is easy to get up and running. Ubuntu doesn't do this by default yet, but it hopefully will at some point in the future.


according to http://wiki.wireshark.org/CaptureSetup/CapturePrivileges you should not run it as root.

Instead, use root privileges to dump using dumpcap or tcpdump and then analyse using wireshark.

  • Ah... but can harm come of using root privileges? May 9 '10 at 5:34
  • 2
    In general, yes/no. Better not to use root where you can get by without it. But if this is just your home machine and you're not going to bring down your office network/servers, fire away. In relation to wireshark, I think you'll be safe enough.
    – bryan
    May 9 '10 at 5:55
  • 2
    unless someone on your network is spewing packets specially crafted to exploit bugs in wireshark; then, using it as root is bad, bad news. May 9 '10 at 8:18

Wireshark has a long history of security bugs in the disectors (the plugins which describe how to interpret various over-the-wire protocols). For that reason, it's safer to perform your captures with a simpler tool such as tcpdump, then use wireshark to interpret them as an unprivileged user.


It depends on what's on your machine really. Do you use a spare laptop just for sniffing? Then run as root. If you have important data on that machine then run tcpdump from the cli and use wireshark to analyze the traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.