dumpcap: SIOCSIWMODE failed: Operation not permitted

Question

When I try to capture in monitor mode in Wireshark after capturing a few packets I get the following error:

Unknown message from dumpcap, try to show it as a string: Can't restore interface wlp18s0 wireless mode (SIOCSIWMODE failed: Operation not permitted).
Please adjust manually.



> ls /usr/sbin/dumpcap -l
-rwxr-x---. 1 root wireshark 83632 Nov  7 18:34 /usr/sbin/dumpcap


> getcap /usr/sbin/dumpcap
/usr/sbin/dumpcap = cap_net_admin,cap_net_raw+eip

Even when I run wireshark with root user I get that error. Any suggestion?

Answer 1

I had the same problem. Run the airmon-ng binary:

sudo airmon-ng start wlan0.

A virtual interface on top of wlan0 will be created with monitor mode enabled.

The output I got using ifconfig is shown below

mon0      Link encap:UNSPEC  HWaddr 88-9F-FA-79-66-C1-3A-30-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2695503 errors:0 dropped:1416652 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:596242234 (596.2 MB)  TX bytes:0 (0.0 B)

Then open wireshark, and select this interface for capturing packets in monitor mode.

Answer 2

This is a libpcap issue. You would probably also see it if you try capturing in monitor mode with tcpdump on that interface by using the -I flag and a -i flag specifying that interface. Please report it on the libpcap issue tracker on GitHub.

Answer 3

Before using wireshark, the dumpcap utility needs to be given permission to run as root. Without this, Wireshark won’t be able to capture network traffic when you are logged in as a normal user (which is always in distributions like Ubuntu). To add the “setuid” bit to dumpcap, use the following command:

sudo chmod 4711 "$(which dumpcap)"