#Wireshark on mac mac os x

To fix that, you can mimic WiresharkвЂ™s own startup item with a Mac OS X launchd job. ThatвЂ™ll work, but youвЂ™ll have to chmod them after every reboot. Most of the solutions on the Web will also just tell you to chmod the /dev/bpf* devices.

This will likely result in a common вЂњno capture interfaces availableвЂќ error in Wireshark itself. Moreover, if youвЂ™re using an unofficial Wireshark package on Mac OS X, such as one obtained through MacPorts (as I am), then you may not even have WiresharkвЂ™s startup item. Instead, I use a Гўв‚¬Е“standardГўв‚¬Вќ account and would recommend you do the same. Using your computer day-to-day as an admin user is generally a very bad idea because it means one wrong click has a much greater chance of causing problems. Therefore, we supply a вЂњstartup itemвЂќ for OS X that will change the ownership of the BPF devices so that the вЂњadminвЂќ group owns them, and will change the permission of the BPF devices to rw-rw-, so that all users in the вЂњadminвЂќ group вЂ“ i.e., all users with вЂњAllow user to administer this computerвЂќ turned on вЂ“ have both read and write access to them. On Mac OS X, the BPF devices live on devfs, but the OS X version of devfs is based on an older (non-default) FreeBSD devfs, and that version of devfs cannot be configured to set the permissions and/or ownership of those devices. Although it seems the official Wireshark package recently lifted the requirement of an admin user, its Mac OS X readme used to say:

#Wireshark on mac for mac os

Some builds for Mac OS X, however, expect you to run Wireshark from an admin user account in order to actually capture network packets. Installing Wireshark is easy enough since various installers are probably already available for your system. ItГўв‚¬в„ўs an industry-standard, open source packet sniffer that you can use for fun and profit. The best general purpose tool for inspecting network activity has gotta be Wireshark. If youГўв‚¬в„ўre anything like me, you often run into a computer problem or five that could be diagnosed more quickly by taking a peek at activity on the network.