[Dario Lombardo <dario.lombardo.ml@xxxxxxxxx>]

On Thu, Dec 18, 2014 at 4:29 PM, Peter Wu <peter@xxxxxxxxxxxxx> wrote:

You should not run Wireshark with sudo, instead set the appropriate
privileges on the dumpcap binary as described at
http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

Generally speaking, you are right, and it's waht I do with my stable wireshark. But with my development version, the setcapped binary is overwritten every time I recompile. So I use the master compiled version with sudo.

 

> What did I do wrong?

I have spend some minutes into debugging it and it turns out that you
cannot have two open sockets for NFLOG.

Reproducer:
$ dumpcap -i nflog -w /dev/null
Capturing on 'nflog'
File: /dev/null
(in a different shell)
$ dumpcap -i nflog -w /dev/null
Capturing on 'nflog'
dumpcap: The capture session could not be initiated on interface 'nflog' (Can't listen on group group index: Operation not permitted).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.

The difference between GTK and Qt is that Qt additionally executes
`dumpcap -S -Z none` which seems to open a socket for each available
interface to collect stats.

At this point I stopped debugging, hope it helps.

If I've got the point, wireshark QT is not expected to work with nflog, right? If stats can't be stopped, it won't work.