Wireshark-users: Re: [Wireshark-users] [Ethereal-users] No interfaces showing on ethereal 0.99 on Mac OS X

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 04 Aug 2006 12:13:00 -0700

Warren Hall wrote:

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxxx
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users

...so I'm redirecting this to wireshark-users (to which replies will go).

I have compiled and installed ethereal 0.99 on my intel based Mac under OS X. The GUI launches and everything seems in order but I have no list of interfaces from which to capture from. My hardware is a MacBook Pro with built-in Gigabit ethernet and 802.11g adaptors.

I am pretty sure my build went OK. Just wondering if I missed something in the ethereal configuration?

No, you missed something in your BSD configuration. :-)

On BSD-flavored systems, such as OS X, libpcap opens a BPF device to do a capture. You'd need to make the BPF devices on your system readable by you in order to capture (you could also run Wireshark as root, but that's overkill, and runs a rather large chunk of code as root).

You could do

	sudo chown {your account name} /dev/bpf*

to do that, but that would have to be done after every reboot. To do that automatically, you could install the ChmodBPF startup item from recent versions of libpcap on your system in /Library/StartupItems and edit the commands in the StartService() shell function in ChmodBPF/ChmodBPF to do the appropriate chown and possibly chmod commands.

I've attached a gzipped tarfile with that startup item.

Attachment: tarfile.gz
Description: GNU Zip compressed data