Ubuntu
libpcap0.8 package

  1. Bug #355613
  2. Comment #2

Comment 2 for bug 355613

Revision history for this message
Daniel Brodie (dbrodie) wrote :

The problem is AppArmor just change it to complain:
# aa-complain /usr/sbin/tcpdump
(WARNING! This will disable apparmor for tcpdump, to reenable use:
# aa-enforce /usr/sbin/tcpdump)

Also you have to run tcpdump so that it will dump th eoutput to a file using the -w command:
# tcpdump -i usb1 -w output

Now you can open output in wireshark and everything will work fine...

Should a bug should be opened to change the default apparmor rule?
Also, shouldn't wireshark have a GUI for capturing from usb in the interfaces dialog?