Arch Linux

fisimann

Member

Registered: 2022-02-18

Posts: 2

Wireshark not working - although in wireshark group

Hi guys !

I can't get wireshark to capture packets by a non-root user. I've added the user to the wireshark group, but it is still not working. When i start up wireshark and select an interface to capture, it says: " ... You don't have permission to capture on that device ...." no matter which device to capture i choose.

Output of "getcap /bin/dumpcap" is "/bin/dumpcap cap_dac_override,cap_net_admin,cap_net_raw=eip"
Output of "ls -l /bin/dumpcap" is "-rwxr-x--- 1 root wireshark"

My user is definetly in that wireshark group. i already rebooted, no luck anyways.

I am using firejail btw. I tried to start wireshark with the --noprofile option by firejail. But also no difference. Dont know what else to do. BTW: tshark gave me same errors

Addtional Informations:

Kernel: 5.16.9-arch1-1
KDE-Plasma: 5.24.1
Filesystem: BTRFS

Thanks in advance !

Last edited by fisimann (2022-02-18 11:10:10)

fisimann

Member

Registered: 2022-02-18

Posts: 2

Re: Wireshark not working - although in wireshark group

Ok...it definetly has something to do with firejail. Although i've used the --noprofile option, it seems that firefail is still involved somehow. I just deleteed the symlink created by firecfg in /usr/local/bin and it is working now !

Thread can be closed, sorry