Tshark requires special permission to use, or more specifically, to use it to monitor an actual interface. The instructions here are summarized from wireshark documentation and should be done as root (or via sudo). I have tested this on raspbian. First create a "wireshark" group:
groupadd -r wireshark
-r makes this a system group. Next we want to set
/usr/bin/dumpcap (used by tshark) so that it can only be used by people in that group:
chgrp wireshark /usr/bin/dumpcap
chmod 754 /usr/bin/dumpcap
Next, we need to set some capabilities on dumpcap so that it can do what it needs to do without being run root:
setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap
Now, anyone who is a member of the wireshark group should be able to use tshark. To add user
usermod -a -G wireshark pi
In order for this new permission to work, you have to log in again. If you use a GUI desktop, just log out and back in. If you are on a console, use
exit until you get back to a login prompt. If you use ssh, just exit and ssh in again (you can also use
login) -- but note actually running tshark via ssh on the same interface that ssh is using will produce an endless circle of output.
You could also just run tshark as root/sudo, but it will warn you this is a bad idea, which it is.
There is a complication on encrypted wifi networks -- you will only be able to read packets involving nodes that connect after you do. So if you want to monitor a WLAN you have control over, you'll have to kick everyone off, shut down the network, start it up again, connect the system with the sniffer and start sniffing, then allow whoever else to connect back on.