Short Abstract: Installing the small dumpcap binary from wireshark-common suid root allows users to run wireshark itself, with all its complexety, as unprivileged users, thus possibly enhancing security.

I know Gentoo does install the dumpcap binary from wireshark suid root, and restricts access to a specific group. The rationale is that wireshark as a whole is rather complicated and thus likely to have security issues. Several such issues have been found in the past. dumpcap however is rather small, and can even drop most of its privileges pretty early. So running wireshark as a normal user and granting dumpcap access including suid root to trusted users seems sensible to me.

Wouldn't it be better to adopt this setup for Ubuntu as well, and remove those "run wireshark as root" items in the applications menu? You could use the admin group for people whom you'd wish to grant capture privileges, or you could introduce a new group.

I've tested the setup here on my system; a simple chgrp and chmod for dumpcap is enough. So it shouldn't be hard.