0

I'm running a raspberry pi with Raspbian (based on the NOOB OS). I connected it to the internet using a Netgear wireless USB dongle. When I run tshark or tshark -D I get an error:

There are no interfaces on which a capture can be done.

I know that my network connection works properly; why isn't it visible to tshark?

Update:

No entry including the word "shark" exists in /etc/group

3

Tshark requires special permission to use, or more specifically, to use it to monitor an actual interface. The instructions here are summarized from wireshark documentation and should be done as root (or via sudo). I have tested this on raspbian. First create a "wireshark" group:

groupadd -r wireshark

The -r makes this a system group. Next we want to set /usr/bin/dumpcap (used by tshark) so that it can only be used by people in that group:

chgrp wireshark /usr/bin/dumpcap
chmod 754 /usr/bin/dumpcap

Next, we need to set some capabilities on dumpcap so that it can do what it needs to do without being run root:

setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap

Now, anyone who is a member of the wireshark group should be able to use tshark. To add user pi:

usermod -a -G wireshark pi

In order for this new permission to work, you have to log in again. If you use a GUI desktop, just log out and back in. If you are on a console, use exit until you get back to a login prompt. If you use ssh, just exit and ssh in again (you can also use login) -- but note actually running tshark via ssh on the same interface that ssh is using will produce an endless circle of output.

You could also just run tshark as root/sudo, but it will warn you this is a bad idea, which it is.

There is a complication on encrypted wifi networks -- you will only be able to read packets involving nodes that connect after you do. So if you want to monitor a WLAN you have control over, you'll have to kick everyone off, shut down the network, start it up again, connect the system with the sniffer and start sniffing, then allow whoever else to connect back on.

  • goldilocks: Thanks for your reply. I did not get any results back from the grep. What should I do? If I do "usermod -a -G wireshark pi" I get "group 'wireshark' does not exist" – RMorrisey Aug 14 '13 at 17:20
  • @RMorrisey : Whoops, sorry. Had not done this for a while and missed a couple of steps. I revised the answer, try from the beginning again (I verified this by doing it myself on the pi, which I had not previously used tshark on, and which also had no wireshark group). – goldilocks Aug 14 '13 at 18:17
  • Thanks! One more question... when I sudo cat /dev/null > usr/bin/dumpcap, I get 'Permission denied' (even if tshark is not running). How can I truncate the contents of the file? – RMorrisey Aug 14 '13 at 20:15
  • @RMorrisey : Not sure what file you are trying to truncate or why, but > /usr/bin/dumpcap would be a bad idea because that would overwrite dumpcap, and it's a binary executable used by tshark -- not anything you want truncated or overwritten. – goldilocks Aug 15 '13 at 7:08
  • Oh! I misunderstood; I thought dumpcap was where the output from tshark gets stored. Good thing the system wouldn't let me overwrite it, then. =) – RMorrisey Aug 15 '13 at 18:31
0

You will need to enable monitor mode on your Wireless card. (if it supports it) Read this: http://wiki.wireshark.org/CaptureSetup/WLAN#Linux

Edit:

Sorry, I thought you just were not seeing traffic that you knew was there, you don't even have an interface.... Is libpcap installed?

  • tshark et. al. will install libpcap as a dependency. – goldilocks Aug 14 '13 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.