Wireshark does not have permission to save files?

sgware · 12-06-2006, 10:57 AM

Hi guys

For some reason every time I try to save a capture file in Wireshark (Ethereal), I get an error message telling me it doesn't have permission to create or edit files. I'm running it as root (well, with 'gksudo' at least since I'm on Kubuntu) and I have access to all my network interfaces... I just don't seem to be able to save files. Any ideas as to why this might be?

Thanks!

matthewg42 · 12-06-2006, 11:03 AM

Are you trying to save the files on a read-only filesystem?

sgware · 12-06-2006, 07:33 PM

No... just in my home folder.

matthewg42 · 12-06-2006, 07:47 PM

What command are you using (paste the error message as well, put it all in [code] tags to aid readability)

sgware · 12-06-2006, 10:26 PM

Well I'm not really using a command... just clicking the save button, which has an image of a floppy disk.

The command used to launch it from the desktop is

Code:

kdesu wireshark

The error message is:

Code:

You don't have permission to move the capture file to "/home/stephen/foo"

Does that help any?

matthewg42 · 12-06-2006, 11:18 PM

can you create a regular file /home/stephen/foo, for example with a text editor?

sgware · 12-06-2006, 11:28 PM

Yes... I have not been getting this error in any other programs. Weird huh?

matthewg42 · 12-06-2006, 11:44 PM

Yup. I'm stumped.

Hangdog42 · 12-07-2006, 06:52 AM

Are you running Wireshark as root or as your normal user? If you are running as root, can you save a plain text file as root?

sgware · 12-08-2006, 02:08 AM

It's launched with the kdesu/gksu command and it prompts me for my root password before starting, so I assume I am using it as root (otherwise, I wouldn't have access to my network interfaces).

Programs like Kate (text editor) can save files to my home folder both as root and non-root and with both the gksu and kdesu commands.

nx5000 · 12-08-2006, 04:51 AM

That's strange and funny !
At this state, You could run it through strace and output to a file.
Then grep for EACCES or ENOENT or /home/stephen/foo and go back a few lines to see what kind of weird thing happen before.

kaniea · 01-05-2008, 11:02 AM

I had the exact same problem and still haven't found the solution. But there is a simple work around. The program stores its traces in /tmp under a filename like etherXXX, the file is already in pcap format so you can just copy it to wherever you like.