середа, 26 жовтня 2011 р.

Dumping traffic (wireshark, tcpdump) without root privileges

The idea: grant privileges (capabilities) to traffic dumper application (setcap to dumpcap).
Tested with: Ubuntu 11.04
Steps (in terminal as root):
addgroup -quiet -system wireshark
chown root:wireshark /usr/bin/dumpcap
setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
usermod -a -G wireshark YOUR_USER_NAME
Recipee details taken from: stream-recorder.com