Re: Wireshark on Ubuntu

nooneinparticular314159@xxxxxxxxx wrote:
I installed Wireshark on Ubuntu. It does not appear to be able to see
any network interfaces when running as an unprivileged user, and only
captures if I run it with sudo, which is a security risk, since it
shouldn't be running as a privileged user. How can I run a capture
without running wireshark as a privileged user?

Thanks!

you could capture with tcpdump -Z <dump_user> -w file -s 0
this will set the nic in prom mode as root and then suiding to the id of
user dump_user

after your capture is finished you can then analyse the dumpfile
../file with wireshark as a normal user (after changing permissions
offcorse)

iirc wireshark can't suid to a less priviledged user after
binding itself to the NIC interface just yet
.

Relevant Pages

  • Re: Continuous internet activity
    ... IP address out of the exercise (dest address for the packets). ... starts the capture. ... Wireshark is not running, and then it is "safe" to transmit ... There is a small probability of a networking problem, ...
    (alt.comp.hardware.pc-homebuilt)
  • Re: Network traffic monitoring: BSD monitor & verifying encryption
    ... I'm only used Wireshark and Ethereal to inspect network traffic, ... you can use tcpdump to ... capture traffic that you can later feed into wireshark for analysis. ... in the traffic that will indicate encryption (e.g., ...
    (freebsd-questions)
  • Re: Wireshark - post-processing capture files.
    ... Monitoring is covered in there. ... Wireshark (I actually use LBL 'tcpdump' to capture the entire packets) ... This tends to identify where the employees are going, ...
    (comp.os.linux.security)
  • Re: Wireshark - post-processing capture files.
    ... I have been using Wireshark for packet capture to detect abuse of my ... in Wireshark to view the information I want, ... Does anybody know of any tools that will parse the capture files? ... You should install a proxy web server (squid was written by the same ...
    (comp.os.linux.security)