Packet capture

The Capture sub-view (Network tab) shells out to tshark for real protocol dissection — not raw frames, actual decoded source/destination/ protocol/info columns, the same as opening Wireshark itself. Capturing packets needs CAP_NET_RAW/CAP_NET_ADMIN, which a normal user doesn’t have by default. kanri doesn’t grant this itself; you configure it once, the same way you would for Wireshark/tcpdump on any system.

The standard way

Most distros already have a mechanism for this via Wireshark’s own packaging:

# Debian/Ubuntu
sudo dpkg-reconfigure wireshark-common   # answer "yes" to the non-superuser prompt
sudo usermod -aG wireshark $USER

# Arch
sudo setcap cap_net_raw,cap_net_admin=eip $(readlink -f $(command -v dumpcap))
sudo usermod -aG wireshark $USER          # if you'd rather scope it to a group

Log out and back in (or reboot) afterward — group membership is fixed for your whole session at login, not per-process. A new terminal window inside an already-running desktop session does not pick up a newly-added group; only a fresh login does.

NixOS example

programs.wireshark = {
  enable = true;
  # dumpcap.enable defaults to true: wraps dumpcap with the capability,
  # restricted to the `wireshark` group (not world-executable).
};
users.users.your_username.extraGroups = [ "wireshark" ];

Why kanri doesn’t just grant this itself

Packet capture can read cleartext credentials off the wire for anyone sharing the same network segment — materially more sensitive than, say, per-process bandwidth counts. That’s worth a deliberate, visible choice on your part, not something a TUI silently arranges the first time you press a key.

Nothing configured?

The Capture sub-view still works without any of this — tshark fails fast (well under a second) with a clear permission error instead of hanging, and kanri shows the whole error, not just its first line.