How to set up wireshark with correct permissions

Question

Ubuntu 13.10, Saucy Salamander here. I am trying to install wireshark in order to monitor USB activity with a certain device. The problem is that wireshark does not have access to the USB bus (or any bus, for that matter, no interfaces show up).

Here they describe, that wireshark can be run either as root, or as an ordinary user. I tired executing dpkg-reconfigure wireshark-common but after the dialog, nothig happens, and I don't know why.

Here an alternative procedure for other Linux users (non-Debian) is outlined. I haven't tried it, as the dpkg method is the recommended one for Ubuntu and I would like to know what is going wrong.

Where should I look?

Debian / Ubutnu Users: Note that the dialog box that shows on setup may be referring to a document that doesn't exist in /usr/share/docs yet (it didn't for me when I was installing the Wireshark package through apt), if you're getting here by googling the message for more information, you can read the document it's referring to here — jrh, May 15 '19 at 14:11

score 2 · Accepted Answer · edited Jan 30 '14 at 12:54

2

I have also run into this in the past (cant speak for SS specifically) This helped me out.

http://ask.wireshark.org/questions/7523/ubuntu-machine-no-interfaces-listed

Basically, this is what needs to be done.

$ sudo apt-get install wireshark
$ sudo dpkg-reconfigure wireshark-common 
$ sudo usermod -a -G wireshark $USER
$ sudo reboot

If there are problems, the linked answer provides more information and techniques.

edited Jan 30 '14 at 12:54

Vorac

3,077

answered Jan 30 '14 at 12:34

DaffyDuc

420
1
3
8

Thanks, I was missing the last step. I took the liberty of plagiatizing some of the content into your answer, in order to make it free-standing and immortal. Thanks a lot! – Vorac Jan 30 '14 at 12:50
1

I already wrote this up on this Q&A: Can't get Wireshark to run as user on CentOS – slm Jan 30 '14 at 12:52
1

You don't need to reboot, but the added group membership won't be available for your current login. If you log out and in again it will work. – goldilocks Jan 30 '14 at 12:58

goldilocks · Answer 2 · 2014-01-30T12:55:59.193

1

Those are really both the same method, just in Debian's case you can toggle it easily with dpkg-reconfigure.

After you select Yes to the question "Should non-superusers be able to capture packets?", you still have to manually allow individual users by adding them to the wireshark group:

(sudo) usermod -a -G wireshark [username]

Note that being added to a group isn't effective for your current login, but only subsequent ones (su yourself counts).

edited Jan 30 '14 at 12:55

answered Jan 30 '14 at 12:36

goldilocks

87,661
30
204
262

I had missed this. However, the situation is still not fixed: no interfaces ara available unless root. sw3@pc90313-sw3:~$ groups sw3 sw3 : sw3 adm cdrom sudo dip plugdev lpadmin sambashare usbuser wireshark – Vorac Jan 30 '14 at 12:44
1

So this was one thing, the other was log out and in again. +1 – Vorac Jan 30 '14 at 12:50
Correct, forgot about the log in/out thing! – goldilocks Jan 30 '14 at 12:53
Unfortunately, now that wireshark works, it still does not see the USB bus (unless root). IMO there are more premissions to be set somewhere. – Vorac Jan 30 '14 at 12:58

score 0 · Answer 3 · answered Jan 30 '14 at 12:35

Wireshark is a network sniffer (it intercepts network activity). USB is a local bus, it doesn't use the network at all. You should look at the Linux USB tools page, and install the tools packaged by your distribution for the task at hand.

The configuration your distribution gives by default should be fine, except for very outlandish use cases. "No user serviceable parts inside" (unless specifically indicated by the manual page/documentation).

How to set up wireshark with correct permissions

3 Answers3