3

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done"

How to implement the solution from Wireshark setup Linux for nonroot user

$ sudo apt-get install wireshark
$ sudo dpkg-reconfigure wireshark-common 
$ sudo usermod -a -G wireshark $USER
$ gnome-session-quit --logout --no-prompt

in Amazon Linux AMI (it's not Ubuntu)?

2
  • Well, first question—does it work as a privileged (root) user?
    – derobert
    Oct 29 '13 at 15:42
  • it does work. i want to configure it without having to sudo tshark
    – rok
    Oct 29 '13 at 21:42
4

Using sudo

I think you need to find out what interface is being used for your network and then just tell tshark about it.

Example

Network devices present on my box.

$ ip addr|grep '^[0-9]'|awk '{print $2}'
lo:
eth0:
wlan0:

Run tshark:

$ sudo tshark -i wlan0 | head -5
..start seeing output from tshark...

Using capabilities

The Amazon AMI instances are based on CentOS so you may be able to use the following steps to accomplish what you're after.

$ sudo groupadd wireshark
$ sudo usermod -a -G wireshark saml
$ setcap cap_net_raw,cap_net_admin=eip /usr/sbin/dumpcap

The above creates the Unix group wireshark, adds the user saml to it, and then adds the capabilities using the tool setcap to allow others access to the dumpcap file.

Example

$ tshark -i wlan0
Capturing on wlan0
  0.000000 108.160.163.38 -> 192.168.1.20 HTTP HTTP/1.1 200 OK  (text/plain)
  0.087199 108.160.163.38 -> 192.168.1.20 TCP http > 38987 [ACK] Seq=180 Ack=352 Win=83 Len=0 TSV=144745749 TSER=195830096
  0.253077 192.168.1.20 -> 255.255.255.255 DB-LSP-DISC Dropbox LAN sync Discovery Protocol
  0.253360 192.168.1.20 -> 192.168.1.255 DB-LSP-DISC Dropbox LAN sync Discovery Protocol
  0.779785 192.168.1.20 -> 74.125.225.115 HTTP HEAD / HTTP/1.1 
...

You can read more about Linux' capabilities facility via the man pages, man capabilities.

References

4
  • Thank you. But my goal is to allow using tshark without sudo.
    – rok
    Oct 29 '13 at 21:41
  • @user1264304 thats what the 'capabilities' bit was all about.
    – phemmer
    Oct 30 '13 at 1:10
  • @user1264304 - see updates.
    – slm
    Oct 30 '13 at 1:16
  • See also: wiki.wireshark.org/CaptureSetup/CapturePrivileges
    – Efren
    Apr 14 '16 at 3:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.