Installing Wireshark on Ubuntu 12.04 LTS

Installing wireshark on Ubuntu 12.04 LTD and limiting packet capture to one group, in this case the group wireshark. I’m sure you can use these instructions for other debian based distributions.

Although you’ll have to take it as read that I’ve only tested it on Ubuntu, feel free to let me know if it doesn’t and I’ll amend the instructions to suit.

First, we install Wireshark from the terminal.

Installing Wireshark

sudo apt-get install wireshark

No interface can be used for capturing in this system with the current configuration

If you run wireshark as a non root user at this stage (see image above), you will get the message “No interface can be used for capturing in this system with the current configuration.”. The following steps will rectify this.

Create the wireshark group.

sudo groupadd wireshark

Add your username to the wireshark group

sudo usermod -a -G wireshark YOUR_USER_NAME

Change the group  ownership of file dumpcap to wireshark

sudo chgrp wireshark /usr/bin/dumpcap

Change the mode of the file dumpcap to allow execution by the group wireshark

sudo chmod 750 /usr/bin/dumpcap

Grant capabilities with setcap

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

Verify the change

sudo getcap /usr/bin/dumpcap

At this point, you will need to log out, then back into Unity (Thanks for Jorge for pointing this out).

You should now be able to run Wireshark as a non-root user, just as long as that user is part on the wireshark group, everything should just work.

References:

Capture, Capture Privileges   for Wireshark
Wireshark Documention
Tavshed – Playing with Technology
No interface issue on Wireshark

16 thoughts on “Installing Wireshark on Ubuntu 12.04 LTS

  1. don’t works, this appears

    Couldn’t run /usr/bin/dumpcap in child process Permission denied

    opening the wireshark and, no interface can be used…

    please help me

  2. Hi Jorge,

    Try logging out, then back in again before starting wireshark. My fault, I’ll amend the instructions above.

    Billy.

  3. Hi lejurassienfou,

    That command shouldn’t be needed to get wireshark to work, I’m happy for you to explain why it is needed though. If you can persuade me, I’ll happily add it and credit you :-)

    Cheers,

    Billy

  4. no need to run all those command, all you have to do is open a terminal, type; sudo -s then type your password, then type; wireshark ;) …. but hey thanks for explaining most of the details here :D

  5. I don’t understand why is it giving me an error “Wireshark:17402): Gtk-Warning **: cannot open display:

    I tried everything but nothing works…. Anyone have any idea?

Leave a Reply