This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to turn on monitor mode on Mac OS X

1

Hello,

I just downloaded wireshark 1.10.2 on my Mac OSX 10.7.5 and I'm trying to capture packets on my home wifi network in monitor mode. I've selected my wifi network (en1) in the interface list and from what I've read so far in other threads and the wireshark wiki I should have an option to check off a "Turn on Monitor mode" checkbox in the Capture Options. However, I do not have that option, it doesn't even show greyed out, the checkbox doesn't exist. Can anyone help me turn on monitor mode using wireshark? Thanks.

asked 21 Oct '13, 18:33

geazi7's gravatar image

geazi7
26113
accept rate: 0%

edited 25 Jan '15, 16:35

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


One Answer:

1

This CheckBox is now deeper in the settings:

Edit / Preferences / User Interface / Capture / Interfaces: / Edit / Device: en1 [x] Monitor Mode

See also:

WLAN (IEEE 802.11) capture setup

It is written on this page somewhere.

This answer is marked "community wiki".

answered 22 Oct '13, 01:10

franc's gravatar image

franc
96349
accept rate: 40%

(22 Oct '13, 01:14) franc

Wow I feel dumb. Just spent way too much time looking for that monitor mode checkmark in latest wireshark on yosemite. google and even wire shark website was useless since it seems info hasn't been updated for latest wireshark version. I guess they really wanted to hide it for some reason!

(10 Dec '14, 18:51) daviangel

Can you post a link to the pages that you think are incorrect so they can be fixed?

(11 Dec '14, 03:37) grahamb ♦

In this page, http://wiki.wireshark.org/CaptureSetup/WLAN#Turning_on_monitor_mode It says, 'there will be a "Monitor mode" checkbox in the Capture Options window in Wireshark'. There is no such checkbox in the Capture Options window, though the configuration summary in that window does indicate whether Monitor Mode is enabled or not (read only).

(25 Jan '15, 14:45) bstriddy

Also it seems that on MacOS 10.10.1 at least, one needs to exit and reopen Wireshark to get the Monitor Mode change to take effect.

(25 Jan '15, 14:53) bstriddy

That's a bug, and I suspect it's not specific to Yosemite, as the code path at the OS X API layer for turning monitor mode on hasn't changed since Leopard (it gets turned on by requesting a non-Ethernet MAC layer header with the BIOCSDLT ioctl) and the libpcap APIs for it have been available in OS X since, I think, Snow Leopard. Please file a bug at the Wireshark bugzilla.

(25 Jan '15, 16:38) Guy Harris ♦♦

LastBuild Qt5 (also does not require X11) https://www.wireshark.org/download/automated/osx/

(26 Jan '15, 03:44) denji

LastBuild Qt5

Yes, turning on monitor mode doesn't appear to work with the Qt UI in OS X; it may not work on any OS. It does, however, work in the GTK+ UI, which is the current standard UI in current releases, so that's a separate problem from the one the person asked about in this question. File a separate bug on the Qt issue.

(26 Jan '15, 21:44) Guy Harris ♦♦
showing 5 of 8 show 3 more comments