Can tshark run under none root permission?

fantasy1215 · 11-03-2011, 05:32 AM

I can't have root right, I can't run tcpdump, so I compile tshark from the src, now I've compiled it successfully, I run command "tshark -f "tcp port 6201" -i eth0 -w ./capture.cap" to capture data, but it complains "Capturing on eth0
tshark: The capture session could not be initiated (You don't have permission to capture on that device).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified."
What does that mean? So I can't capture any data without root permission? I really need to monitor my port data flow.
Thanks in advance!

chrism01 · 11-03-2011, 09:30 PM

Actually, you probably can run tcpdump: consider the following

Code:

which tcpdump      #NB: I ran this cmd as root to ensure I could find it
/usr/sbin/tcpdump
ll /usr/sbin/tcpdump
-rwxr-xr-x 1 root root 729772 Jul 13  2006 /usr/sbin/tcpdump

so it can be run by anyone IF you supply the absolute/complete path.
Whether you have perms to monitor a given port/device is a different qn; if you haven't, ask your SysAdmin.