Upgraded from Mountain Lion to Mavericks. Reinstalled XQuartz and then reinstalled Wireshark 1.10.2. Wireshark runs correctly, and in the list of available interfaces it lists them all. However only traffic on the WiFi connection (en0) is being detected and captured. Traffic on the ethernets that are connected to my thunderbolt-to-ethernet adapter (en3) or on my Apple Display (en4) is not being detected. When running Mountain Lion prior to the upgrade, traffic was detected correctly on all interfaces. Does anyone have any ideas on how to solve the issue? It looks like a permission issue not allowing access to the other interfaces, but I can't find a solution (yet...). For the record, the computer is one of the new Macbook 15" with retina display. asked 26 Oct '13, 10:06  ik8sqi |
One Answer:
Please run the following command and check if there are any differences regarding the ownership and access rights of those devices.
If so, please adjust the other devices to what you see for /dev/bpf0. Regards answered 28 Oct '13, 08:34  Kurt Knochner ♦ Not having permissions to open the BPF devices would prevent you from capturing on any interface. I'll look at the Mavericks XNU source to see if there's anything obvious that would limit access to some but not all interfaces. (28 Oct '13, 15:31) Guy Harris ♦♦ |
What happens if you try capturing on those interfaces with tcpdump? If that fails in the same fashion, it's a Mavericks bug, not a Wireshark bug.