This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

can’t run Wireshark in Mac OS X - Mountain Lion

4
1

Why doesn't Wireshark start in Mac OS X Mountain Lion?

asked 24 Jun '12, 19:57

teulong's gravatar image

teulong
61●1●3●3
accept rate: 0%

edited 26 Jul '12, 16:53

helloworld's gravatar image

helloworld
3.1k●4●20●41

6 Answers:

9

I'm having problems as well... Double-clicking on the Wireshark icon, or launching via Alfred doesn't do anything. I did install XQuartz since upgrading to ML.

I might have found a work-around for myself however:

  1. Launch XQuartz so you see X11 running in the foreground. (It's installed under /Applications/Utilities/XQuartz.app)
  2. Open a new xterm with Applications -> Terminal (or Command+N)
  3. Type: open /Applications/Wireshark.app/

et. voila! At least on my 2009 MBP with Wireshark 1.8.1 and ML installed as an upgrade from Lion. YMMV.

-- UPDATE:

If Xquartz is running, and I double click the wireshark icon, nothing happens.

If Xquartz is not running, i get

xterm: Xt error: Can't open display: 
xterm: DISPLAY is not set`

I believe you're right that apps are not doing the Launch-on-demand for XQuartz.

However, there might also be a DISPLAY issue as well. With Xquartz running, and from a Terminal (not xterm) I run: /Applications/Wireshark.app/Contents/MacOS/Wireshark it produces the following:

(process:7287): Gtk-WARNING **: Locale not supported by C library.
    Using the fallback 'C' locale.

(wireshark-bin:7287): Gtk-WARNING **: cannot open display:

Then… run export DISPLAY=:0

And retry launching /Applications/Wireshark.app/Contents/MacOS/Wireshark.

Works!

Two issues for the price of one?

answered 26 Jul '12, 14:52

zachad's gravatar image

zachad
331●1●4●9
accept rate: 21%

edited 26 Jul '12, 15:58

If Xquartz is already running, what happens if you double-click on the Wireshark icon? Does Wireshark launch?

If Xquartz is not already running, and you try to run xterm, does xterm fail to launch?

If so, then the problem is that, for whatever reason, the Xquartz server and/or the X11 libraries it installs are not doing launch-on-demand of the X server.

(26 Jul '12, 15:07) Guy Harris ♦♦

(updated my original post because it got too lengthy for a comment field - see above)

(26 Jul '12, 15:58) zachad

OK, I've forgotten what part(s) of OS X created the UNIX-domain socket in /tmp, set up with launchd as a launch-on-demand socket for X11, and set DISPLAY to that in some or all processes in a session, but it might not be doing that any more in Mountain Lion, given that Mountain Lion doesn't ship with X11.

(26 Jul '12, 16:08) Guy Harris ♦♦

You, sir, are the man. The "DISPLAY=:0" trick worked for me.

(27 Jul '12, 14:53) boettger1

Nope, my guess was wrong - if you install XQuartz and log out after doing so and log back in again, it sets up X11 to launch on demand. Logging out and back in again is important, as it causes DISPLAY to be set correctly.

(13 Sep '12, 11:54) Guy Harris ♦♦

7

I managed to get it to work as it did in Lion (without changing any X11 settings). These are my steps from memory...

  1. Upgrade from Lion to Mountain Lion.
  2. Open /Applications/Utilities/X11.app, which prompts you to install X11 (the Install button actually opens a web page that tells you to install Xquartz). Install XQuartz. This will change X11.app to /Applications/Utilities/XQuartz.app.
  3. Install Wireshark, using the installer from http://wireshark.org.
  4. Open /Applications/Wireshark.app, which shows the Wireshark icon in the dock and a picker dialog, titled Where is X11?, listing the apps from /Applications.
  5. From the picker dialog, click Browse button, and choose /Applications/Utilities/XQuartz.app. This appears to do nothing other than show the XQuartz icon in the dock and open xterm.
  6. Right-click the Wireshark icon, and choose Quit. Do the same for the XQuartz icon.

At this point, the link to X11 should be setup properly so that opening /Applications/Wireshark.app works as it did in Lion. That is, it automatically opens XQuartz (if not already open), followed by the Wireshark application.

Side note

Before I tried step 3-6 above, I built wireshark (SVN 44057) on my machine and ran it with XQuartz. I don't think building it is necessary, but FYI.

I have several MacPorts libraries installed, including xorg-libX11 (seems to play fine with XQuartz). Your build will fail at a few warnings in version_info.c about Gestalt being deprecated, which I resolved by hard-coding the values to match 10.8.0. I was able to start wireshark without any prompts or changing X11 settings.

answered 26 Jul '12, 16:49

helloworld's gravatar image

helloworld
3.1k●4●20●41
accept rate: 28%

The only additional step would be that after you've installed Quartz, you need to log out and log back in. That will set the DISPLAY environment variable correctly.

Otherwise, you can set it on the command line zachad mentioned.

(15 Aug '12, 13:13) jmwhite5

(Not really relevant to the main issue, but, as for building Wireshark on Mountain Lion, current top-of-trunk Wireshark no longer uses Gestalt(); as Apple supplies no replacement API, it just directly reads /System/Library/CoreServices/SystemVersion.plist. I've also updated the macosx-setup.sh script so that if you're not using libraries from MacPorts you can run the script to build and install the relevant support libraries.)

(13 Sep '12, 11:40) Guy Harris ♦♦

And, yes, jmwhite5 is right - as I remember from a recent installation of XQuartz on a freshly-created Mountain Lion virtual machine, it tells you to log out and log back in again to get DISPLAY set correctly.

(13 Sep '12, 11:43) Guy Harris ♦♦

after step 6, Wireshark take some time to load

(13 Mar '13, 07:35) MasseGuillaume

2

As noted in other answers, install XQuartz first; if you try to launch X11 from /Applications/Utilities/X11.app, it will pop up a window with a link to the XQuartz Web site. Click that link; that'll take you to a page with a download link for the latest version of XQuartz.

After you install XQuartz, log out and log back in again; that will cause the DISPLAY environment to be set correctly to launch X11 on demand. (This is automatic; you don't need to set it yourself, once you log out and log back in again.)

answered 13 Sep '12, 11:57

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

0

You did install Xquartz, right? X11 isn't bundled with Mountain Lion, and Wireshark currently requires X11, so you need to install it separately (although there's a claim out there that attempting to run X11 programs on Mountain Lion will, at least, direct you to the Xquartz Web site to download and install it).

If you didn't install Xquartz, do so.

If you did install Xquartz, what errors are reported in Console when you try to run Wireshark?

answered 25 Jun '12, 17:52

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

edited 25 Jun '12, 19:25

helloworld's gravatar image

helloworld
3.1k●4●20●41

I'm not getting any shark love on ML either right now. 1.8.1 installed. XQuartz 2.7.2 installed. Seeing this in the console:

7/25/12 1:01:08.503 PM Wireshark[2628]: Performance: Please update this scripting addition to supply a value for ThreadSafe for each event handler: "/Library/ScriptingAdditions/Insync.osax"

(25 Jul '12, 13:06) turboladen

0

Here is what I had to do to get Wireshark 1.8.4 (latest as of December 20, 2012) running on Mountain Lion. Note this is a one-time step. Once you follow this, you can open Wireshark like any other OS X application.

1) I deleted the previous version of Wireshark from my Applications folder and downloaded the latest 2) I deleted Wireshark preferences from ~/Library/Preferences 3) Download and install Xquartz (log out and log back in) 4) Launch Xquartz and use its shell to go to /Application/Wireshark.app/Contents/MacOS 5) sudo ./Wireshark

Now Wireshark should launch correctly, including the proper display of fonts. There should no longer be a pop-up window like I described above where it just hangs.

NOTE: It's important that in step 5 you type sudo ./Wireshark and not sudo Wireshark otherwise when Wireshark launches you won't see fonts and Wireshark will automatically close. Once launched correctly, you should now be able to simply click on the Wireshark icon in the Applications folder to load Wireshark like before.

I'm not suggesting this is the best way, the only way, or even the right way, but when the other steps here failed, this is how I got it to work.

answered 20 Dec '12, 11:44

MarkH's gravatar image

MarkH
1●1
accept rate: 0%

edited 23 May '13, 07:37

Running Wireshark was root isn't recommended, even on magical machines. See the Capture Privileges page on the Wiki for more info.

(21 Dec '12, 01:26) grahamb ♦

I agree, but it's a one-time thing just to get it working properly. After the first time running as root, you don't need to do this again and can simply launch is the same as alway under your regular OS X login.

(23 Dec '12, 18:58) MarkH

Solution given my MarkH works for me

(23 May '13, 07:29) tapeshm

0

In my case it was way easier. I've installed wireshark via macports. Then I've installed Quartz. After running Quartz, I've added a new application with command 'wireshark', then booted it from quartz's menu and voila. Everything works.

answered 12 Nov '13, 16:56

sasklacz's gravatar image

sasklacz
1
accept rate: 0%

Presumably you mean "installed XQuartz" (the logo at the top of the page is a bit confusing, but the name of the project is "XQuartz", not just "Quartz" - "Quartz" is the low-level graphics layer in OS X, which comes with the OS, "XQuartz" is an X11 server that runs atop that graphics layer, and which must be installed from that site on Mountain Lion and later).

(12 Nov '13, 17:07) Guy Harris ♦♦