Ubuntu machine - no interfaces listed

Question

I've tried the procedures listed in the CaptureSetup/CapturePrivileges, and the Debian specific file, but still see no interfaces. I saw an earlier post referring to bpf* file permissions, but this appears to only be relevant to Mac OS X users. I'm running Ubuntu 10.04 LTS. Any ideas?

Accepted Answer

EDIT: The instructions from README.Debian actually do work (except it's missing the step that tells you to log out and then back in). The dpkg-reconfigure command creates the wireshark group (so you don't need to), but then you need to add your user to the group, and re-login.

These commands work for me with Wireshark 1.6.2 on Ubuntu Server 11.10 (64-bit):

$ sudo apt-get install wireshark
$ sudo dpkg-reconfigure wireshark-common 
$ sudo usermod -a -G wireshark $USER
$ sudo reboot

Instead of rebooting, you can logout with this command:

Ubuntu Desktop:

$ gnome-session-quit --logout --no-prompt

Ubuntu Server:
```
$ pkill -KILL -u $USER 
```

or simply (if you're already at the login shell):

$ exit

If the solution above still fails on your system, an alternative is to set the setuid bit for dumpcap (which lets dumpcap run effectively as the owner of the file, which is root in this case):

$ sudo chmod 4711 `which dumpcap`

(FYI: There's an open ticket for this "security vulnerability", but no one seems to have done anything about it since it was reported JAN-2010.)****

Answer 2

7

Complete solution found at http://cmc.site11.com/?p=2165

sudo addgroup -system wireshark
sudo chown root:wireshark /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
sudo usermod -a -G wireshark YOUR_USER_NAME

Then just start Wireshark and select the network interface. It worked for me on 10.04 LTS.

answered 04 Apr '12, 11:41

kyphos
106●2●2
accept rate: 0%

bravo!!! these commands works fine in my ubuntu 12.04 lts thnk..

(13 Jan '13, 11:13) dipesh

Yes It's Working

(31 Jan '13, 02:45) Rajitha

Did this as it seemed quicker than the other methods - seems to be working :)

(15 Mar '14, 09:40) alexgmcm

on mu ubuntu 13.10 and wireshark Version 1.10.2 (SVN Rev 51934 from /trunk-1.10) works perfect!!!!

(22 May '14, 10:05) nicksat

Worked perfectly for me on Xubuntu 14.04. Well done and thank you.

(12 Jun '14, 19:35) funklebits

Its work for me, Using Ubuntu 14.04. Thank you buddy. @kyphos

(30 Jul '14, 09:31) gamer_h2so4

Thanks, perfect, Raspberry Pi, RPi

(24 Feb '15, 03:59) Diez66

Yep, worked for me too!

(10 Apr '15, 15:14) herogee

CAN I GET SOME HELP? What do i do with the sudo? where would i add them?

(13 Oct '16, 12:54) JKeaney

You don't add them anywhere. You run these commands just once, in the order given. sudo allows you to execute commands as superuser although you're not logged in as such.

What you actually do is:

sudo addgroup -system wireshark - you add a new group of users called wireshark

sudo chown root:wireshark /usr/bin/dumpcap - you make user root and group wireshark the owners of /usr/bin/dumpcap which is the binary which actually does the capture. With this setting, any member of the group wireshark can start the binary

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap - allow the binary to access the interfaces and capture on them

sudo usermod -a -G wireshark YOUR_USER_NAME - you make Mr. YOUR_USER_NAME also a member of the group wireshark (also because he remains a member of his original group), so if that user runs Wireshark, that instance of Wireshark can start dumpcap.

(13 Oct '16, 13:26) sindy

showing 5 of 10 show 5 more comments

Answer 3

sudo groupadd wireshark
sudo usermod -a -G wireshark $USER
sudo chgrp wirshark /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap