Wireshark is one of the world's foremost network protocol analyzers, and is the standard in many parts of the industry. It is the continuation of a project that started in 1998. Hundreds of developers around the world have contributed to it, and it it still under active development.
Wireshark has a rich feature set which includes the following:
Standard three-pane packet browser
Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
Multi-interface: Along with a standard GUI, Wireshark includes TShark, a text-mode analyzer
This program has been very useful in troubleshooting tracking and analytics. Using the GA debugger only helps for chrome, using this we can see the call any browser makes or even a connected iPad or iPhone!
The right way to get this to work is NOT to run it as root or to screw around with the permissions of /dev/bpf*. Set the permissions of the dumpcap executable to something like root:wheel rwsr--r-- (NOT rwsr-xr-x), and add an ACL entry for each user who needs to run Wireshark. For example, to enable user foo to capture packets,
sudo chmod +a "foo allow execute" $( which dumpcap )
Starts up but can't find any interfaces. Not surprised since it's never tried to authenticate. I then ran Command Line tool 'sudo wireshark' which worked but gave me glaring warning about running as root. So what do people do to run wireshark on mac os x?
The first time you sudo on any *nix-style OS, it will give you the warning about great power and great responsibility. Which is good, as indiscriminate use is hazardous to your health. To give Wireshark access to the interfaces on your mac, take a look at the README (in chmodBPF, inside the Utilities folder on the dmg).
4. You will probably need to adjust the permissions of /dev/bpf* in order to capture. You can do this by hand or by dragging the ChmodBPF folder onto the StartupItems alias.
I tried the second method (startupitems) and rebooted, but received an alert that I lacked required permissions to perform the chmods. After manually running the chgrp/chmod with sudo, WireShark ran just fine.
So I'm not sure what they had in mind by putting the ChmodBPF folder into /Library/StartupItems. My default login has Mac OS X Administrative privileges. Will I need to reissue those chgrp/chmod commands next time I reboot?
Please login or create a new MacUpdate Member account to use this feature
Watch Lists are available to MacUpdate Desktop Members Upgrade Now
Download and auto-install
using MacUpdate Desktop. Save
time moving folders and cleaning-up.
Wireshark is one of the world's foremost network protocol analyzers, and is the standard in many parts of the industry. It is the continuation of a project that started in 1998. Hundreds of developers around the world have contributed to it, and it it still under active development.
Wireshark has a rich feature set which includes the following:
Standard three-pane packet browser
Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
Multi-interface: Along with a standard GUI, Wireshark includes TShark, a text-mode analyzer which is useful for remote capture, analysis, and scripting
The most powerful display filters in the industry
VoIP analysis
Live capture and offline analysis are supported
Read/write many different capture file formats: tcpdump (libpcap), NAI's Sniffer™ (compressed and uncompressed), Sniffer™ Pro, NetXray™, Sun snoop and atmsnoop, Shomiti/Finisar Surveyor, AIX's iptrace, Microsoft's Network Monitor, Novell's LANalyzer, RADCOM's WAN/LAN Analyzer, HP-UX nettl, i4btrace from the ISDN4BSD project, Cisco Secure IDS iplog, the pppd log (pppdump-format), the AG Group's/WildPacket's EtherPeek/TokenPeek/AiroPeek, Visual Networks' Visual UpTime and many others
Capture files compressed with gzip can be decompressed on the fly
Hundreds of protocols are supported, with more being added all the time
Coloring rules can be applied to the packet list, which eases analysis
-2
-4
Anon42 reviewed on 28 Mar 2012
+24
frequencydip reviewed on 04 Nov 2011
+7
JohnKHeath reviewed on 22 Oct 2011
-1443
+19
+1
+7
JohnKHeath reviewed on 05 Oct 2011
angelowales79 reviewed on 30 Sep 2011
+1
+4
lcj005 reviewed on 08 Jun 2011
+544
+544
+5
+127
sudo chmod +a "foo allow execute" $( which dumpcap )
+33
+42
4. You will probably need to adjust the permissions of /dev/bpf* in order to capture. You can do this by hand or by dragging the ChmodBPF folder onto the StartupItems alias.
I tried the second method (startupitems) and rebooted, but received an alert that I lacked required permissions to perform the chmods. After manually running the chgrp/chmod with sudo, WireShark ran just fine.
So I'm not sure what they had in mind by putting the ChmodBPF folder into /Library/StartupItems. My default login has Mac OS X Administrative privileges. Will I need to reissue those chgrp/chmod commands next time I reboot?
+41
Current download is: http://www.wireshark.org/download.html
+2
Lachtigall rated on 02 Nov 2011
FAM9 rated on 03 Jun 2011