If you do a lot of network capture and packet analysis, Brim will revolutionize your workflow.īrim is very new, so it hasn’t yet made its way into the software repositories of the Linux distributions. When you want to see the granular level Wireshark can provide, Brim instantly opens it for you exactly on those packets.

It acts as an interactive preprocessor and front-end for Wireshark. Each delay disrupts your concentration, which can hinder your progress.īrim is the remedy for these woes. Every time you perform a search or change a filter, you have to wait for the effects to be applied to the data and updated on the screen. Working with files of that size is a real pain. Just opening and loading a very large (anything over 1 GB) trace can take so long, you’d think Wireshark had keeled over and given up the ghost. The larger the packet capture (or PCAP), the more laggy Wireshark becomes. This is especially true if the issue you’re trying to investigate is complex or sporadic, or the network is large and busy.

Network data capture files (called network traces or packet captures), can get very large, very quickly. Everything I can find says to set the perms and caps on dumpcap, and I should be able to see ethernet interfaces inside Wireshark.As great as Wireshark is, though, it does have one issue. If I run it as my normal user, all I see are ciscodump, dpausmon, ranpkt, sdjournal, sshdump and udpdump. If I run wireshark via sudo, I see the local network interfaces. usr/bin/dumpcap cap_net_admin,cap_net_raw=eip rwsr-x- 1 root wireshark 116928 Jun 7 15:16 /usr/bin/dumpcap Tty network wireshark libvirt docker users uucp optical disk audio wheel ddjones Permissions on dumpcap are set, and setcap run (several times.) I can run dumpcap directly via CLI from my normal user and capture packets: ╰─❯ groups

I am a member of the network and the wireshark groups, and have not only logged out but have completely rebooted the computer since adding myself to those groups. Running Arch linux, wireshark installed via pacman.

Wireshark arch