Wireshark-dev: Re: [Wireshark-dev] Is there some way to have multiple documents open with Wires
From: Guy Harris <[email protected]>
Date: Sat, 26 Feb 2011 11:16:38 -0800
On Feb 26, 2011, at 11:07 AM, Richard Sharpe wrote:

> I wanted to compare two captures a few days ago and I could not think
> of any way to do that with Wireshark on Mac OS X (10.6 or something).

Run multiple instances of Wireshark.

OS X's GUI-application model is different from the common Windows and UN*X+X11 model; in the former, one process handles all open files, and in the latter, separate processes are started for each open file.  In *some* instances, one process handles multiple open items - e.g., Web browsers usually have one process to handle all windows, and some terminal emulators have one process for all windows.

Wireshark is written for the common Windows and UN*X+X11 model (that's not surprising, as it was originally developed for UN*X+X11), and currently can't implement the OS X model - that'd take a significant amount of work.  It's an X11 application, even on OS X, so to act as a "normal" OS X application requires a wrapper app; the wrapper app we're using in the OS X binary distribution appears to be smart enough that if, for example, you double-click on multiple files, it starts multiple instances of Wireshark.