Does Wireshark have to be run in kernel mode (system mode) on Red Hat Enterprise Linux?

asked 2019-07-17 18:30:54 +0000

I am new to using Wireshark on Red Hat Enterprise Linux and was wondering if it has to be run in kernel mode or can it be run in user mode.

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2019-07-17 19:50:15 +0000

Guy Harris
19890 ●3 ●634 ●207

There is nothing in Wireshark that can run in kernel mode! It's 100% user-mode code.

If you mean "can it be run without root privileges on Linux?", that depends on whether the dumpcap component is installed with elevated privileges. That can be done on Debian and on Debian derivatives such as Ubuntu; I don't know what installation options for that are available on RHEL.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-07-17 18:30:54 +0000

Seen: 468 times

Last updated: Jul 17 '19

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

Does Wireshark have to be run in kernel mode (system mode) on Red Hat Enterprise Linux? edit

1 Answer