Ubuntu – Wireshark – allow non-root user to sniff USB traffic

networkingpermissionsrootusbwireshark

I'm trying to capture data transferred across a USB connection to reverse-engineer the protocol used. I'm using wireshark to do this, which explicitly warns against running as root. So far, I've installed wireshark and run the following commands:

sudo dpkg-reconfigure wireshark-common
to allow members of the wireshark group (me) to access network interfaces

sudo chmod +x /usr/bin/dumpcap
not sure what that does, but I think dumpcap was previously only executable by root.

sudo usermod -aG wireshark (me)
to add me to the wireshark group

This allows me to sniff network interfaces without running as root, but I still can't see the USB interfaces.

running
gksudo wireshark
runs wireshark as root and I can see usb interfaces then.

Is there a step I've missed to make USB sniffing possible for non-root users? I don't mind having to run wireshark as root for now, but it seems like I may as well set it up properly.

Best Answer

I solved it... running

sudo setcap CAP_NET_RAW,CAP_NET_ADMIN,CAP_DAC_OVERRIDE+eip /usr/bin/dumpcap

adds the CAP_DAC_OVERRIDE property to the dumpcap program. This allows it to bypass the usual restriction checks for reading and writing to interface devices (if I understand it correctly)

Related Solutions

Ubuntu – How to run wireshark, with root-privileges

For WireShark there's a better way. The bit that normally needs root is the packet collection application and this can be configured to allow certain people to use it without sudo, gksu, etc.

In a terminal (very important that you're in a terminal, not just the Alt+F2 dialogue) run this:

sudo dpkg-reconfigure wireshark-common

This will ask you if you want to allow non-root user to be able to sniff. That's what we're aiming for, so select Yes and hit return.

Reconfiguring wireshark-common

This adds a wireshark group. Anybody in that group will be able to sniff without being root. This is obviously more secure than just letting anybody sniff but does mean there's no password checking. Technically any person with access to a computer logged in with a wireshark account will be able to sniff. If that's acceptable to you, carry on.

If not, run that again and select no.

Then you just need to add the user to that group. Run this:

sudo adduser $USER wireshark

And restart or log out. When you're back in it should let you start sniffing without any fuss about being root.

Ubuntu – How to allow non-root access to /ttyUSB0

It's possible this is related to modemmanager, as detailed here.

I removed that (sudo apt-get remove modemmanager) and it fixed my problem.

You still need to be in the dialout group though.

Best Answer

Related Solutions

Ubuntu – How to run wireshark, with root-privileges

Ubuntu – How to allow non-root access to /ttyUSB0

Related Question