how to begin the wireshark packet capture mac

Using your computer day-to-day as an admin user is generally a very bad idea because it means one wrong click has a much greater chance of causing problems. Therefore, we supply a “startup item” for OS X that will change the ownership of the BPF devices so that the “admin” group owns them, and will change the permission of the BPF devices to rw-rw-, so that all users in the “admin” group – i.e., all users with “Allow user to administer this computer” turned on – have both read and write access to them. On Mac OS X, the BPF devices live on devfs, but the OS X version of devfs is based on an older (non-default) FreeBSD devfs, and that version of devfs cannot be configured to set the permissions and/or ownership of those devices. Although it seems the official Wireshark package recently lifted the requirement of an admin user, its Mac OS X readme used to say: Some builds for Mac OS X, however, expect you to run Wireshark from an admin user account in order to actually capture network packets.

Installing Wireshark is easy enough since various installers are probably already available for your system. Itâ€™s an industry-standard, open source packet sniffer that you can use for fun and profit. The best general purpose tool for inspecting network activity has gotta be Wireshark. If youâ€™re anything like me, you often run into a computer problem or five that could be diagnosed more quickly by taking a peek at activity on the network.

How to begin the wireshark packet capture mac