<SNIP>
So the question is whether we should print/pop up a message if TShark/Wireshark is running as root - and, if we do, whether we should have a compile or configuration option to disable that, so it can be disabled on Kali Linux or other OSes where you don't have much of a choice about whether to run them as root.
+1 for this. I haven't entirely followed the preceding technical discussion as it's mostly about platforms I have little knowledge about, but this in general seems to be a fair approach. Of course there will be those who have no need to run as "root", who will ignore the advice and disable the warning and continue to run as "root" on the way to ruin. So be it, we will have tried.
