This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark won’t start on mac if I run it as root

0

Hi there,

When I launch wireshark, it closes immediately.. I tried running through terminal.. Get this message back.

(process:5464): Gtk-WARNING **: Locale not supported by C library. Using the fallback 'C' locale.

(wireshark-bin:5464): Gtk-WARNING **: cannot open display:

Help please.

asked 23 Mar '14, 08:06

klipie245's gravatar image

klipie245
1●1●1●1
accept rate: 0%

edited 30 Jul '14, 09:14

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196

Can you post the output of 'tshark -v'?

(23 Mar '14, 10:53) Hadriel

same problem, here's tshark -v:

sh-3.2# tshark -v TShark 1.10.8 (v1.10.8-2-g52a5244 from master-1.10)

Copyright 1998-2014 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.36.0, with libpcap, with libz 1.2.3, without POSIX capabilities, without libnl, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.1, without Python, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP.

Running on Mac OS X 10.9.4, build 13E28 (Darwin 13.3.0), with locale en_US.UTF-8, with libpcap version 1.3.0 - Apple version 41, with libz 1.2.5. Intel(R) Xeon(R) CPU E5462 @ 2.80GHz

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.9.00).

(30 Jul '14, 01:09) shonen

One Answer:

2

sh-3.2#

Don't run Wireshark as root:

  1. If you installed the standard Wireshark bundle, it shouldn't be necessary in order to capture traffic.
  2. WIRESHARK CONTAINS OVER TWO MILLION LINES OF SOURCE CODE. DO NOT RUN THEM AS ROOT.
  3. Processes running as root are generally not allowed to open a connection to your X server, causing a "cannot open display" error.

Don't run TShark as root, either, for much the same reason.

answered 30 Jul '14, 09:13

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

edited 30 Jul '14, 09:15

Oops, that was left over from some cleanup work, via su. The problem changes a little with my own user account, but still can't open the display:

Mac-Pro:bin will$ ./wireshark 2014-07-30 12:04:33.945 defaults[30092:507] The domain/default pair of (kCFPreferencesAnyApplication, AppleAquaColorVariant) does not exist 2014-07-30 12:04:33.958 defaults[30093:507] The domain/default pair of (kCFPreferencesAnyApplication, AppleHighlightColor) does not exist

(process:30082): Gtk-WARNING **: Locale not supported by C library. Using the fallback 'C' locale.

(wireshark-bin:30082): Gtk-WARNING **: cannot open display: Mac-Pro:bin will$ ./tshark -v TShark 1.10.8 (v1.10.8-2-g52a5244 from master-1.10)

Copyright 1998-2014 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.36.0, with libpcap, with libz 1.2.3, without POSIX capabilities, without libnl, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.1, without Python, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP.

Running on Mac OS X 10.9.4, build 13E28 (Darwin 13.3.0), with locale en_US.UTF-8, with libpcap version 1.3.0 - Apple version 41, with libz 1.2.5. Intel(R) Xeon(R) CPU E5462 @ 2.80GHz

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.9.00).

(30 Jul '14, 16:18) shonen
1

What gets printed if you run /usr/X11/bin/xterm?

(30 Jul '14, 16:45) Guy Harris ♦♦

Sorry, I think I missed a reboot after my Xquartz re-install. Everything is working now. Thanks for the help.

(01 Aug '14, 10:17) shonen