CODEWITHSUNDEEP
ubuntuwiresharklinux-capabilities
Konrad Eisele
Konrad Eisele

Reputation: 3194

Wireshark dumpcap with setcap set to no-root capture failes to start in Ubuntu 18.10

I have recompiled the latest version of Wireshark with prefix /my-path/bin/ and want to setup non-root capture of packets. However when I set

setcap cap_net_raw,cap_net_admin=eip /my-path/bin/dumpcap

then somehow dumpcap cannot be started anymore and exits with: 

/my-path/bin/dumpcap: error while loading shared libraries: libwsutil.so.0: cannot open shared object file: No such file or directory

/my-path/lib/libwsutil.so.0 is present and if I revert the capabilities with

setcap -r /my-path/bin/dumpcap

I can run dumpcap again. Is there some security feature that I need to take into account? I'm running Ubuntu 18.10.

Upvotes: 1

Views: 1106

Answers (1)

stubbfel
stubbfel

Reputation: 16

I ran into this same issue too today. I "fixed" it by changing the working folder:

setcap cap_net_raw,cap_net_admin=eip /my-path/bin/dumpcap
cd /my-path/bin
./dumpcap

Upvotes: 0

Related Questions