Wireshark-users: Re: [Wireshark-users] Mac OSX new MacBook Pro

From: Eric Ridvan Üner <eric.uner@xxxxxxx>
Date: Mon, 30 Oct 2006 20:36:56 -0600

I see the same behavior on my MacBook Pro.

I spoke with Apple a couple times, and they were able to reproduce the problem with tcpdump on an Intel machine. They confirmed it's a bug, but said they "don't support command-line utilities", and finished off saying that they may or may not investigate it further.

So is there a solution for running wireshark without dropping the connection? I realize this isn't a wireshark problem, pre se, but is there a workaround anyone has had luck with?

Doc


On Oct 30, 2006, at 10:00 AM, Mike Savory wrote:

Thank you Guy

Yes you are correct, sudo tcpdump does also drop the connection on
en1 as it starts capturing on en0, weird
Tshark  version is the current MacPorts - TShark 0.99.3a

Just rebuilding svn so I can grab a source...  ;-)
(its a very new laptop)

Mike


On Oct 30, 2006, at 1:23 AM, Guy Harris wrote:

Mike Savory wrote:

Details below were just to show that the build on my Laptop is using
libpcap 0.9.4 my PPC laptop uses 0.8.3

I can capture packets and remain attached to my wireless running
perfectly

sudo tcpdunp -i en1

When I run

sudo tshark -i en1

It immediately drops the wireless.