You can read more about Linux' capabilities facility via the man pages, man capabilities. Go back to your Wireshark screen and press Ctrl + E to stop capturing. The Wireshark installer from 3.0 onwards includes Npcap, where versions before include WinPcap.Even with the older Wireshark versions Npcap might work better for you, especially if you run Windows 10. One of them must be installed in order to capture live network traffic on Windows. Visit the URL that you wanted to capture the traffic from. Npcap and WinPcap are Windows versions of the libpcap library. Click on the Start button to capture traffic via this interface. Youll want to capture traffic that goes through your ethernet driver. The above creates the Unix group wireshark, adds the user saml to it, and then adds the capabilities using the tool setcap to allow others access to the dumpcap file. $ setcap cap_net_raw,cap_net_admin=eip /usr/sbin/dumpcap The Amazon AMI instances are based on CentOS so you may be able to use the following steps to accomplish what you're after. Run tshark: $ sudo tshark -i wlan0 | head -5 I think you need to find out what interface is being used for your network and then just tell tshark about it.

Wireshark capture interface