linux普通用戶權(quán)限 wireshark 抓包

時(shí)間：2019-10-09 10:58:01

關(guān)鍵字： wireshark

手機(jī)看文章

掃描二維碼
隨時(shí)隨地手機(jī)看文章

[導(dǎo)讀] Setting network privileges for dumpcap 1. Ensure your linux kernel and filesystem supports File C

Setting network privileges for dumpcap

1. Ensure your linux kernel and filesystem supports File Capabilities and also you have installed necessary tools.

2. "setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap"

3. Start Wireshark as non-root and ensure you see the list of interfaces and can do live capture.

Limiting capture permission to only one group

1. Create user "wireshark" in group "wireshark".

2. "chgrp wireshark /usr/bin/dumpcap"

3. chmod 754 /usr/bin/dumpcap

4. "setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap"

5. Ensure Wireshak works only from root and from a user in the "wireshark" group

注意，如果是自己通過(guò)源代碼編譯安裝的wireshark一般默認(rèn)路徑是安裝在/usr/local/bin/dumpcap, 所以需要指定正確的路徑。

其余系統(tǒng)可以參考下面的鏈接http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

這個(gè)鏈接是在第一次使用root運(yùn)行wireshark抓包顯示的，我想大部分人應(yīng)該不會(huì)去注意提示信息吧。