programs.wireshark: use setcap wrapper

nixos/modules/misc/ids.nix

···
       kresd = 270;
       rpc = 271;
       geoip = 272;
-      #wireshark = 273; # unused
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
···
       kresd = 270;
       #rpc = 271; # unused
       #geoip = 272; # unused
-      wireshark = 273;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/programs/wireshark.nix

···
 with lib;
 
 let
-
   cfg = config.programs.wireshark;
   wireshark = cfg.package;
-
-in
-
-{
-
+in {
   options = {
-
     programs.wireshark = {
-
       enable = mkOption {
         type = types.bool;
         default = false;
         description = ''
           Whether to add Wireshark to the global environment and configure a
-          setuid wrapper for 'dumpcap' for users in the 'wireshark' group.
+          setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
         '';
       };
-
       package = mkOption {
         type = types.package;
         default = pkgs.wireshark-cli;
···
           Which Wireshark package to install in the global environment.
         '';
       };
-
     };
-
   };
 
   config = mkIf cfg.enable {
-
     environment.systemPackages = [ wireshark ];
-    
+    users.extraGroups.wireshark = {};
+
     security.wrappers.dumpcap = {
       source = "${wireshark}/bin/dumpcap";
+      capabilities = "cap_net_raw+p";
       owner = "root";
       group = "wireshark";
-      setuid = true;
-      setgid = false;
       permissions = "u+rx,g+x";
     };
-
-    users.extraGroups.wireshark.gid = config.ids.gids.wireshark;
-
   };
-
 }