Permission to capture on device for non-root user (tshark)

NotionCommotion · 01-22-2017, 09:26 AM

How do I use tshark as a user other than root? I added "wireshark" group to the user, but no change. Thanks

Code:

[Michael@devserver ~]$ sudo tshark -i wlan0 -f "udp port 47808"
Running as user "root" and group "root". This could be dangerous.
Capturing on wlan0
^C0 packets captured
[Michael@devserver ~]$ tshark -i wlan0 -f "udp port 47808"
Capturing on wlan0
tshark: The capture session could not be initiated (You don't have permission to capture on that device).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.
0 packets captured
[Michael@devserver ~]$ groups
Michael wheel wireshark www phped
[Michael@devserver ~]$

Turbocapitalist · 01-22-2017, 09:50 AM

There are some instructions provided by tshark itself here:

http://wiki.wireshark.org/CaptureSet...turePrivileges

Alternatively, you could also run the capture through tcpdump instead. In that way you could either save to a file and then analyze the file's contents or else capture directly via some bash tricks known as process substitution.

Code:

sudo tcpdump -i eth0 -w foo.pcap; 
tshark -r foo.pcap;

# or

tshark -r <( sudo tcpdump -i eth0 -w - )