Run tshark/wireshark In Docker

Posted on Edited on In Views: Word count in article: 73 Reading time ≈ 1 mins.

Last week when I was trying to run tshark in a Docker container to capture http packets, tshark reported following error even with root user:

1
tshark: Couldn't run /usr/bin/dumpcap in child process: Operation not permitted

After searching, to access dumcap, we need to add --cap-add options when start container, then add user into wireshark group:

1
2
docker run --cap-add=NET_RAW --cap-add=NET_ADMIN $IMAGE
usermod -a -G wireshark $USER