I have a command which works great at the terminal:
sudo tshark -V -l -i 'any' -f 'udp port 4729'
I trying to read the output from my python script:
import subprocess
import shlex
output = subprocess.check_output(shlex.split("""sudo tshark -V -l -i "any" -f 'udp port 4729'"""))
print output
I receives nothing. But when I press ctrl+c, I receives this:
[email protected]:~/workspace/glade_tests/src$ sudo ./main.py
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled
Running as user "root" and group "root". This could be dangerous.
Capturing on Pseudo-device that captures on all interfaces
^C164 packets captured
Traceback (most recent call last):
File "./main.py", line 84, in <module>
output = subprocess.check_output(shlex.split("""sudo tshark -V -l -i "any" -f 'udp port 4729'"""))
File "/usr/lib/python2.7/subprocess.py", line 538, in check_output
output, unused_err = process.communicate()
File "/usr/lib/python2.7/subprocess.py", line 746, in communicate
stdout = _eintr_retry_call(self.stdout.read)
File "/usr/lib/python2.7/subprocess.py", line 478, in _eintr_retry_call
return func(*args)
KeyboardInterrupt
As you can see there is the "164 packets captured" line, which means that thark was working. But where is the output of tshark? Can you help me with this?
Also tried to use it like this:
import subprocess
command = ['tshark', '-V', '-l', '-i', '"any"', '-f', '"udp port 4729"'] # the shell command
process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=None)
output, error = process.communicate()
print output
I receive the error:
[email protected]:~/workspace/glade_tests/src$ sudo ./main.py
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled
Running as user "root" and group "root". This could be dangerous.
Capturing on "any"
tshark: The capture session could not be initiated (No such device exists).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.
0 packets captured
asked 04 Mar '14, 23:25
Gooman
1●1●1●2
accept rate: 0%
No, it doesn't work without sudo (just in the terminal). It doesn't without sudo because I catch packets from my device which connected to the USB, so Ubunti Linux doesn't give the access to this USB without root rules.
It will work without root (sudo), if you follow the steps to correctly configure privilege separation.
See here:
The important part is "setcap" for dumpcap!