If you use a filesystem that supports posix capabilities, an easy way to start wireshark as a normal user, while still providing it with all of the access permissions it requires, is by issuing the following command: $ setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap One may also test if things are ok running this command as a normal user: $ dumpcap -L You may also create a special group (wireshark) and include users allowed to monitor networks in that group: # addgroup -S wireshark # manually add your username to /etc/group in the wireshark line # chgrp wireshark /usr/bin/dumpcap # chmod 750 /usr/bin/dumpcap # setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap Other users not in the group wireshark can still open files with previously saved monitorings and inspect them.