wireshark: capturing usbmon* does not work as non-root

[httpdev]

Nixpkgs version

• Stable (24.11)

Describe the bug

When enabling wireshark, the permissions for the /dev/usbmon* devices are not set correctly, they need to be readable by the wireshark user the same way as the network interfaces. Instead, they are owned by root. This prevents non-root users from capturing/analyzing USB traffic using wireshark.

The fix is to add

services.udev.packages =
[
    (pkgs.writeTextDir "etc/udev/rules.d/85-wireshark-usbmon.rules" ''
        SUBSYSTEM=="usbmon", MODE="0640", GROUP="wireshark"
    '')
];

to the configuration.

In my opinion, this should be done by default or there should be an option to enable it. I can write a pull request, but I want to be sure which one is the preferred route.

Steps to reproduce

1. Add

programs.wireshark.enable = true;

to config & rebuild.
2. run wireshark
3. in "Capture Options", select Input > "usbmon0"
4. error message about missing permissions (with misleading text, it appears to assume network capture permission issues rather than USB)

Expected behaviour

Wireshark should capture USB traffic

Screenshots

No response

Relevant log output

Additional context

No response

System metadata

• system: "x86_64-linux"
• host os: Linux 6.12.8, NixOS, 24.11 (Vicuna), 24.11.20250106.3f0a8ac
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.24.11
• channels(root): "nixos-24.05"
• nixpkgs: /nix/store/fz4h8yz3qr83p6cfhisgj02knjqg6nxs-source

Notify maintainers

@bjornfor @fpletz

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.