Do not execute wireshark in root mode, it may damage files. If the usbmon* files have 'crw-', then it's normal that Wireshark cannot read them because it's not run as root. Now display the permissions of the usbmon interfaces: If the usbmon interfaces don't appear in Wireshark, look for interfaces using dumpcap (the command-line tool of Wireshark): See () for more information about this differentiation. Sudo mount -t debugfs / /sys/kernel/debugįor kernel version 2.6.21 and later, load the loadable module usbmon in the Kernel: `sudo modprobe usbmon`

To know the version of your kernel, type:įor versions of the kernel prior to 2.6.21, if debugfs is not already mounted on /sys/kernel/debug, ensure that it is mounted there by issuing the following command: This step depends on the kernel version that is installed on your machine. Important: Logout of your session, then log back in. If not, you can add the group 'wireshark' manually:Īnd then add your username to the group (see above) You can verify if it’s done correctly by displaying the groups your username is part of: Reconfigure wireshark to allow non-superusers to track packets:Īdd your username to the 'wireshark' usergroup:

Sudo apt-get install wireshark libpcap0.8įor Debian, Ubuntu and other Debian derivatives, continue to step 3.įor other Linux based systems or other installation methods, see the Wireshark Wiki, then go to step 6. When you restart your computer, you have to repeat steps 6 and 7 to see the USB interfaces in Wireshark. The first time you follow the tutorial, do all the steps 1 -> 7.

Tested on Ubuntu 14.04, but probably works on other distributions since none of the steps are specific to Ubuntu.

Wireshark ubuntu download