1

Scenario:

I am attempting to run WireShark through xming server located on a windows 8.1 machine off of a Raspberry Pi B+ that is hardwired to a Wifi Pineapple Mark 5.

Xming successfully launches with the following command

pi@raspberrypi~$ wireshark -i interface name

However when I attempt to access (any of the interfaces including one generated with airmon-ng) I get

"You don't have permission to access this interface"

from wireshark.

So naturally I say, "Derp, you need to run it with sudo"

When I run

pi@raspberrypi~$ sudo wireshark -i interface name

xming doesn't connect and it says

PuTTY X11 proxy: wrong authorisation protocol attempted
(wireshark:3123): Gtk-WARNING **: cannot open display: localhost:10.0

I am at a total loss as to why this is happening.

I researched it a little and most suggest adding

"ForwardX11Trusted yes"

to my sshd_config file but when I do this and attempt to restart my ssh server it says that it is a bad key. I also tried ssh_config. I didn't get a restart error but I still experienced the same xming issues.

enter image description here enter image description here

1 Answer 1

5

This is normal. You've connected to your Pi as user pi, asking ssh (or PuTTY in this case) to forward your X connection to your desktop. This only allows user pi on the Pi to access your X server on your desktop; when you run wireshark as root, since root on your Pi doesn't have access to your X server you see the error message you've given.

I'll give you the ssh solution, but it's the wrong approach in this case; I'll give you the right approach for wireshark as well.

In general, to run an X program as some other user than the user with which you've connected to a remote machine, you need to merge the X authority information. In this case, to allow root to connect to your desktop, run the following on your Pi:

xauth extract - $DISPLAY | sudo xauth merge -

This extracts your pi user's X authority and merges it with your root user's X authority. You may get a warning about /root/.Xauthority not existing; that doesn't matter, xauth will create the file for you. You should now be able to run wireshark as root.

But running wireshark as root isn't recommended; security holes are found regularly in Wireshark... /usr/share/doc/wireshark/README.Debian gives two possible approaches. The first is to run dumpcap as root to capture all the traffic you're interested in, then run wireshark to analyse the generated output (and you could run dumpcap on your Pi, then use Wireshark on your desktop computer). The second is to add your pi user to the wireshark group and reconfigure Wireshark to allow members of the wireshark group to capture traffic; you can do this by running the following on your Pi:

adduser pi wireshark
sudo dpkg-reconfigure wireshark-common

and pick "Yes" in the configuration screen. Then run wireshark as pi.

2
  • So I attempted both of your solutions and they both seem to be on the correct path and exactly what I am looking for. That said, the first method results with "xauth: file /root/.Xauthority does not exist xauth: timeout in locking authority file /root/.Xauthority xauth: (argv):1: unable to read any entries from file "(stdin)"" and your second one results in "adduser: The group `wireshark' does not exist. " Any ideas? Apr 30, 2015 at 19:55
  • I am marking this as the answer because though it wasn't what did it, it led me to the correct answer. I did need to configure privgs. Found the answer here wiki.wireshark.org/CaptureSetup/CapturePrivileges Apr 30, 2015 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .