26 January 2016

Enable All interfaces in Wireshark

If you are running Ubuntu or Linux Mint, the wireshark may not list all the interfaces except bluetooth. There is a small workaround for enabling all the interfaces within wireshark

To install wireshark
$ sudo apt-get install wireshark

Checking for all the interfaces
$] ifconfig -a 
eth0      Link encap:Ethernet  HWaddr b4:b5:2f:90:41:98  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:5528 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5528 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:522095 (522.0 KB)  TX bytes:522095 (522.0 KB)

wlan0     Link encap:Ethernet  HWaddr 68:17:29:15:7f:9d  
          inet addr:192.168.0.103  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::6a17:29ff:fe15:7f9d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:487713 errors:0 dropped:0 overruns:0 frame:0
          TX packets:336698 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:591668376 (591.6 MB)  TX bytes:41118839 (41.1 MB)

To check the interfaces shown by the dumpcap

$] dumpcap -D -M (following line is the output)
1. bluetooth0 4 network

Enable the following commands in linux to make it work.
$] sudo groupadd wireshark$] sudo usermod -a -G wireshark $USER$] sudo chgrp wireshark /usr/bin/dumpcap$] sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

$] dumpcap -D -M (following is the output)
dumpcap
dumpcap

T S Pradeep Kumar