I believe Wireshark has always given that warning dialog box if you're running as root. As to why you can't see Facebook credentials, I suspect that Facebook uses HTTPS on their login page (I'm not a Facebook user, so I don't know that for sure). Have you tried searching through your pcap file for several likely strings? Things like "user", "uname", "username", "login", "pw", "pass", etc.


