ubuntu - How to install Wireshak on Linux and capture USB traffic? -

- July 15, 2014

i have encountered numerous problems in installation of wireshark, , capture of usb traffic, due user permissions.

in answer, describe full workflow doing that. answers each individual problems given on different forums, thought i'd bring in 1 answer, avoid future users google every single issue encounter.

tested on ubuntu 14.04, works on other distributions since none of steps specific ubuntu.

the first time follow tutorial, steps 1 -> 7.

when restart computer, have repeat steps 6 , 7 see usb interfaces in wireshark.

install wireshark , libpcap:

sudo apt-get install wireshark libpcap0.8
for debian, ubuntu , other debian derivatives, continue step 3.

for other linux based systems or other installation methods, see wireshark wiki, go step 6.
reconfigure wireshark allow non-superusers track packets:

sudo dpkg-reconfigure wireshark-common

select <yes> in prompt
add username "wireshark" usergroup:

sudo usermod -a -g wireshark <your_username>

you can verify if it’s done correctly displaying groups username part of:

groups <your_username>

if not, can add group "wireshark" manually:

groupadd wireshark

and add username group (see above)
important: logout of session, log in.
this step depends on kernel version installed on machine. know version of kernel, type:

uname -r

for versions of kernel prior 2.6.21, if debugfs not mounted on /sys/kernel/debug, ensure mounted there issuing following command:

sudo mount -t debugfs / /sys/kernel/debug

for kernel version 2.6.21 , later, load loadable module usbmon in kernel:

sudo modprobe usbmon

see wireshark wiki more information differentiation.
if usbmon interfaces don't appear in wireshark, interfaces using dumpcap (the command-line tool of wireshark):

sudo dumpcap -d

you should see usbmon* interfaces. display permissions of usbmon interfaces:

ls -l /dev/usbmon*

if usbmon* files have 'crw-------', it's normal wireshark cannot read them because it's not run root. do not execute wireshark in root mode, may damage files. instead, make them accessible other users:

sudo chmod 644 /dev/usbmon*