haaworx.blogg.se

Here’s one minimally modified from a MacPorts patch for this issue: To fix that, you can mimic Wireshark’s own startup item with a Mac OS X launchd job. That’ll work, but you’ll have to chmod them after every reboot. Most of the solutions on the Web will also just tell you to chmod the /dev/bpf* devices. This will likely result in a common “no capture interfaces available” error in Wireshark itself. Moreover, if you’re using an unofficial Wireshark package on Mac OS X, such as one obtained through MacPorts (as I am), then you may not even have Wireshark’s startup item. Instead, I use a “standard” account and would recommend you do the same. Using your computer day-to-day as an admin user is generally a very bad idea because it means one wrong click has a much greater chance of causing problems. Therefore, we supply a “startup item” for OS X that will change the ownership of the BPF devices so that the “admin” group owns them, and will change the permission of the BPF devices to rw-rw-, so that all users in the “admin” group – i.e., all users with “Allow user to administer this computer” turned on – have both read and write access to them. On Mac OS X, the BPF devices live on devfs, but the OS X version of devfs is based on an older (non-default) FreeBSD devfs, and that version of devfs cannot be configured to set the permissions and/or ownership of those devices.

Although it seems the official Wireshark package recently lifted the requirement of an admin user, its Mac OS X readme used to say: Some builds for Mac OS X, however, expect you to run Wireshark from an admin user account in order to actually capture network packets. Installing Wireshark is easy enough since various installers are probably already available for your system. It’s an industry-standard, open source packet sniffer that you can use for fun and profit. The best general purpose tool for inspecting network activity has gotta be Wireshark. If you’re anything like me, you often run into a computer problem or five that could be diagnosed more quickly by taking a peek at activity on the network.