Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] No interfaces, no /dev directory (MacOS X)

From: Steven Ross <wireshark.org@xxxxxxxxxxxxxxxx>
Date: Mon, 5 Sep 2011 22:03:10 -0700
On Sep 5, 2011, at 19:54 , Guy Harris wrote:

You may not have a /dev folder, in the sense of something that the Finder will show you, but you definitely have a /dev directory, in the sense that, for example, "ls /dev" from a Terminal window will show you the contents of that directory.

Thanks for the explanation of the /dev directory. Confirmed everything you said and it does show there /dev/bpf0 to /dev/bpf6. I learned something new today. :-)


In order for it to be run, /Library/StartupItems/ChmodBPF, and all the files under it, must be owned by user "root" and group "wheel", and must not have group or other write privileges.

ls -l in StartupItems shows:

total 0
drwxr-xr-x  5 root  wheel  170 Jul 18 13:27 ChmodBPF

and inside that directory, it shows:

total 24
-rwxr-xr-x  1 root  wheel   959 Jul 18 13:27 ChmodBPF
-rw-r--r--  1 root  wheel  2551 Jul 18 13:27 README.macosx
-rw-r--r--  1 root  wheel    84 Jul 18 13:27 StartupParameters.plist

So, it looks like it meets the requirement you mentioned, doesn't it? This is what the Wireshark 1.6.1 installer created, I didn't change anything. Yet, no interfaces. I'm not exactly an expert on UNIX, so any help greatly appreciated!