This is our old Q&A Site. Please post any new questions and answers at

Hello, loved the product. However, I'm done messing around and now cannot figure out how to fully uninstall from my mac? I've tried searching the documentation as well as this question area and cannot find any step by step guide on how to safely and easily uninstall?

Any help would be much appreciated!

asked 18 Jan '11, 16:11

Pblocked's gravatar image

accept rate: 0%

The installer .dmg contains a file called "Read me first.rtf" with the following info/instructions:

What changes does the installer make?

The installer writes to the following locations:

• /Applications/Wireshark. The main Wireshark application. • /Library/StartupItems/ChmodBPF. A script which adjusts permissions on the system's packet capture devices (/dev/bpf*) when the system starts up. • /Library/Wireshark. A wrapper script and symbolic links which will let you run Wireshark and its associated utilities from the command line. You can access them directly or by adding /Library/Wireshark to your PATH.

Additionally a group named access_bpf is created. The user who opened the package is added to the group.

How do I uninstall?

  1. Remove /Applications/Wireshark
  2. Remove /Library/Wireshark
  3. Remove /Library/StartupItems/ChmodBPF
  4. Remove the access_bpf group.
permanent link

answered 22 Jul '11, 09:49

charris's gravatar image

accept rate: 0%

yes, but how do you uninstall the virtual ports it creates?

(24 Jul '11, 07:33) bwanaaa

What do you mean by "virtual ports"? What are examples of these virtual ports?

(24 Jul '11, 15:37) Guy Harris ♦♦

vmnet1 and vmnet8 are still there when you issue ifconfig on a mac in terminal

(27 Jul '11, 05:14) bwanaaa

That's because they're NOT created by Wireshark (really - they are NOT created by Wireshark), they're created by VMware Fusion; to get rid of them, you'll have to uninstall VMware Fusion.

(27 Jul '11, 10:19) Guy Harris ♦♦

oops. sry. tnx.

(27 Jul '11, 15:11) bwanaaa

Hi, but how do I remove the access_bpf group? or more correctly, where do I find the group?


(26 Sep '11, 05:44) Ant
showing 5 of 6 show 1 more comments

You just need to drag the application to the TrashCan. The only other two files I've found that lie outside of the application itself are pref folders. I'll assume that you did NOT manually install the command-line tools. If your local username is Pblocked then these would be: /Users/Pblocked/.wireshark/ /Users/Pblocked/.wireshark-etc

You can delete them by opening a terminal window and typing rm -rf ~/.wireshark*

Once you've deleted the application and those two directories you can scan your drive for any leftovers - but again, I haven't found any on mine and I've gone through several versions of WireShark on my system.

You can scan your drive with this command: sudo find / -iname "*ireshark*" -print | grep -v denied

permanent link

answered 20 Jan '11, 06:56

GeonJay's gravatar image

accept rate: 5%

edited 20 Jan '11, 07:03

Note that "drag-uninstalling" any app won't get rid of preferences for the app; some might consider that a feature (as in "if I later decide I want the app again, I don't lose my preferences). That's not unique to Wireshark.

AppZapper supposedly cleans up other stuff for apps, including preferences, when you uninstall them; whether it knows about Wireshark, which follows UN*X dotfile/dotdirectory conventions rather than NeXTStEP/OS X .plist conventions for its preferences, is another matter.

(26 Jan '11, 19:36) Guy Harris ♦♦

I searched far and wide for hidden prefs, application support files, etc. I'm thinking that because of WireShark's "ported" nature it doesn't behave in the same manner as usual Mac applications. I'd bet that I missed something though.

(27 Jan '11, 12:07) GeonJay

Yes - as I noted, Wireshark stores the personal configuration files in traditional UN*X style; that means that various personal configuration are stored in ~/.wireshark rather than ~/Library/Preferences etc.

(22 Jul '11, 11:21) Guy Harris ♦♦

I had Wireshark 2 RC and a legacy GTK dev version. I wanted to delete everything and start from scratch with latest W2.

I uninstalled the following files

/Applications/Wireshark [dev build].app
/Library/Application Support/Wireshark
~/Library/Application Support/CrashReporter/wireshark-bin_*.plist
~/Library/Saved Application State/org.wireshark.Wireshark.savedState

Since I was reinstalling I didn't need to remove access_bpf, but in this other topic is explained how to.

sudo dscl . -delete /Groups/access_bpf
permanent link

answered 16 Feb '16, 09:00

wsk's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 18 Jan '11, 16:11

question was seen: 68,459 times

last updated: 16 Feb '16, 09:00

p​o​w​e​r​e​d by O​S​Q​A