Wireshark on Ubuntu

I installed Wireshark on Ubuntu. It does not appear to be able to see
any network interfaces when running as an unprivileged user, and only
captures if I run it with sudo, which is a security risk, since it
shouldn't be running as a privileged user. How can I run a capture
without running wireshark as a privileged user?

Thanks!

On 2008-04-26, (E-Mail Removed) <(E-Mail Removed)> wrote:
>
>
> I installed Wireshark on Ubuntu. It does not appear to be able to see
> any network interfaces when running as an unprivileged user, and only
> captures if I run it with sudo, which is a security risk, since it
> shouldn't be running as a privileged user. How can I run a capture
> without running wireshark as a privileged user?
>
> Thanks!

Wouldn't it be a security risk if an unprivileged user could see the
contents of every network packet?

(E-Mail Removed) wrote:
> I installed Wireshark on Ubuntu. It does not appear to be able to see
> any network interfaces when running as an unprivileged user, and only
> captures if I run it with sudo, which is a security risk, since it
> shouldn't be running as a privileged user.

It shouldn't?
http://www.wireshark.org/docs/wsug_h...uisitesSection

--
As we enjoy great advantages from inventions of others, we should be
glad of an opportunity to serve others by any invention of ours;
and this we should do freely and generously.
--Benjamin Franklin

johnny bobby bee <useraddshine-(E-Mail Removed)> writes:
> It shouldn't?
> http://www.wireshark.org/docs/wsug_h...uisitesSection
Exactly. The same is true for TCPDUMP or any other packet sniffer.

--
Allan

(E-Mail Removed) wrote:
> I installed Wireshark on Ubuntu. It does not appear to be able to see
> any network interfaces when running as an unprivileged user, and only
> captures if I run it with sudo, which is a security risk, since it
> shouldn't be running as a privileged user. How can I run a capture
> without running wireshark as a privileged user?
>
> Thanks!

you could capture with tcpdump -Z <dump_user> -w file -s 0
this will set the nic in prom mode as root and then suiding to the id of
user dump_user

after your capture is finished you can then analyse the dumpfile
../file with wireshark as a normal user (after changing permissions
offcorse)

iirc wireshark can't suid to a less priviledged user after
binding itself to the NIC interface just yet