Ubuntu – wireshark config/packet socket support

networkingwireshark

Day Three of using Ubuntu and yet another question.

Today I installed Wireshark. Upon starting for the first time, I am told that "No interface can be used for capturing in this system with the current configuration"

below that is "Capture Help"
followed by "HOW TO CAPTURE – A step by step guide to a successful capture set up"
Guide is as follows:

How To Set Up a Capture

Step 1: Are you allowed to do this?

Step 2: General Setup

Step 3: Capture traffic "sent to" and "sent from" your local machine

Step 4: Capture traffic destined for machines other than your own

Step 5: Capture traffic using a remote machine

Step 1, ok !
Step 2 is where i am stuck…

You will need to make sure the machine on which you're running is configured to support packet capture, e.g. you might need a capture driver installed. The way this is done differs from operating system to operating system."

Linux

On Linux, you need to have "packet socket" support enabled in your kernel; see the "Packet socket" item in the Linux "Configure.help" file. Your distribution might enable this by default in the kernel."

Could somebody please tell me how I go about having packet socket support enabled please ?

Many thanks in anticipation

Best Answer

The "No interface can be used for capturing in this system with the current configuration" message commonly appears when you don't have the privileges to access the network interfaces for monitoring. Try opening a terminal and running gksudo wireshark. If several network interfaces appear, it's because when you run wireshark without root permissions you don't have the privileges to monitor.

To fix that, run the following command in a terminal:

sudo setcap CAP_NET_RAW,CAP_NET_ADMIN,CAP_DAC_OVERRIDE+eip /usr/bin/dumpcap

a little explanation is available on this other AskUbuntu question

Related Question