This link has been bookmarked by 1 people . It was first bookmarked on 14 Jun 2008, by Avdi Grimm.
When starting the new WireShark you will notice that you can't do any sniffing, as there are no network interfaces available.
To allow this, the BPF devices need to be accessable by WireShark. For more details have a look into Utilities → Startup → README.macosx on the WireShark disk image.
The following commands in Terminal will install the necessary files to set the BPF permissions. Then all users with administrator rights will be able to sniff packets.
sudo -s cd /Library/StartupItems cp -pR /Volumes/Wireshark/Utilities/Startup ChmodBPF chown -R root:wheel ChmodBPF exit
After a reboot, WireShark should be able to access all network interfaces.
If you want to be able to use the WireShark utilities on the command line (Terminal), install some small scripts on your system.
sudo install -p /Volumes/Wireshark/Utilities/Command\ Line/* /usr/local/bin
If you haven't installed the WireShark application into /Applications, you have to tell the command line scripts, where to find it.
Open .profile with an editor and add the line
export WIRESHARK_APP_DIR="<Directory, where WireShark resides>/Wireshark.app"
Then close all existing Terminal windows. With a new Terminal session you should be able to access WireShark utilities.
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.