Wireshark Capure as Regular User

Wireshark can run as a regular user. It doesn’t need root access and will give an error if you run it as root.

Option 1: Add Network Capabilities

Your kernel should support this, and is simple to setup.

sudo setcap cap_net_raw,cap_net_admin+eip /usr/sbin/dumpcap

Add the user to the ‘wireshark’ group.

sudo groupadd -s wireshark
sudo gpasswd -a $USER wireshark

Then add setuid. (You may need to replace /usr/sbin with /usr/bin).

sudo chgrp wireshark /usr/sbin/dumpcap

sudo chmod o-rx /usr/sbin/dumpcap