Ok, I've used the MAC OSX 64 bit installer for the latest version of Wireshark, copied the command line folder and dragged the ChmodBFP to StartupItems alias. My installation doesn't seem to have a /dev folder, and I'm struggling to find where the 'BPF' devices live ! asked 17 Feb '11, 09:47  Tim Arnold |
One Answer:
What's the question you're asking? "Why isn't it letting me start a capture even though I've installed the ChmodBPF startup item?", or "where are the BPF devices?" The answer to the first question is "because, unfortunately, dragging ChmodBPF to StartupItems isn't good enough." You also need to open up a Terminal window (in an admin account) and do and, once you've done that, you also have to do to force that startup item to be run now, rather than only after a reboot. Once that's done, you shouldn't need to do those again. The answer to the second question is "they live in the /dev directory". Mac OS X is UN*X - and, starting with Leopard, it's UNIX(R) - so it has "directories", not "folders", at the lowest level; a "folder" is what a directory looks like from higher levels in the OS, such as the Finder. The Finder won't show you /dev, but the UNIX command line will - in Terminal, do, for example, "ls /bpf". answered 17 Feb '11, 21:02  Guy Harris ♦♦ |
Guy, many thanks, done all that, but devices still not showing in the GUI. Do I need to edit the ChmodBPF file to recongine my 'admin group'? The file has this in (as the defaukt'
chgrp admin /dev/bpf chmod g+rw /dev/bpf
Devices won't ever show in the GUI - as I said, "The Finder won't show you /dev". Or by "the GUI" do you mean the drop-down list in the Capture Options window in the Wireshark GUI?
What do you mean by "my 'admin group'"? Users who have "Allow user to administer this computer" are in the system's "admin" group, and the ChmodBPF script will, by default, make the BPF devices usable by anybody in that group, so they can capture network traffic with tcpdump or *shark or dumpcap or....
You can open any directory in the GUI if you choose go to location from the menu and type it in. You just can't browse to there.
You can open almost every directory in the GUI; /dev is not one of the ones you can open (try it with Go To Folder - the Finder informs you that "The folder can't be found").