This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

It appears that I have a continuing problem with Mavericks and Wireshark. While I had it running a bit ago, now I see that I cannot launch it from Wireshark in Applications. I see it bounce once in the Dock and then vanish. I have current versions of XQuartz and Wireshark. If I launch XQuartz and then 'wireshark' from an xterm/Terminal window in that X11 environment, Wireshark will appear after several minutes and I can work. (The long pause at first-run has to do with building a font cache. Once done, subsequent launches go quicker.)

I uninstalled Wireshark using AppDelete and then reinstalled with no change in this one-bounce-and-gone behaviour.

If quit Wireshark and XQuartz and then try from a regular Terminal window, I get:

===

$ wireshark

2014-04-15 19:09:59.966 defaults[37571:507]

The domain/default pair of (kCFPreferencesAnyApplication, AppleAquaColorVariant) does not exist

(process:37561): Gtk-WARNING **: Locale not supported by C library.

Using the fallback 'C' locale.

(wireshark-bin:37561): Gtk-WARNING **: cannot open display:

===

Looks like environment variables are corrupted or missing and the X11 display is not called. What might be handy to know is how to return to a clean slate before installing XQuartz and Wireshark. I am guessing some things that hang around after an uninstall/reinstall are causing trouble.

Any ideas? I figure if I can launch it from Terminal, it will launch from Applications.

asked 15 Apr '14, 02:19

pjconmac's gravatar image

pjconmac
11113
accept rate: 0%

converted to question 17 Apr '14, 03:10

grahamb's gravatar image

grahamb ♦
19.8k330206


I have seen threads on this unusual behavior before. Most will discuss cleaning up XQuartz. When I encountered an issue that seemed very similar to yours, I reinstall XQuartz and it resolved my issue.

Here is another very active thread about unusual issues under Mavericks:

http://ask.wireshark.org/questions/26326/apple-maverick-and-x11

permanent link

answered 17 Apr '14, 15:31

stjaru's gravatar image

stjaru
1222
accept rate: 0%

edited 17 Apr '14, 15:32

With OS X Mountain Lion and newer, Apple no longer ships the X11 framework with the Core OS. You'll have to download and install XQuartz:

http://support.apple.com/kb/ht5293

https://xquartz.macosforge.org/landing/

I've also noticed that some major updates (10.9.0 -> 10.9.1) have forced me to re-install XQuartz.

permanent link

answered 21 Apr '14, 09:22

mire3212's gravatar image

mire3212
11114
accept rate: 0%

I fully uninstalled Wireshark, reinstalled and tested, seeing the same behaviour. I reinstalled XQuartz as suggested above, seeing the same behaviour when launching Wireshark. By the way, there are details on uninstalling Wireshark in the README that accompanies the Wireshark installer. There are also several symlink files (like 'tshark') that point to the 'wireshark' item, all in '/usr/local/bin'. I deleted all those during that session also. (I did notice that 'ls -l' showed the owner of 'wireshark' as 'macports'. I have MacPorts installed but not its wireshark package.)

My current solution is to install the latest development version of Wireshark, which is based on Qt and does not require X11/XQuartz, It is a full OS X application. It has quite a different look but should work just fine. If not, I can return to the X11/xterm-launched 'wireshark' method.

Cheers,

Paul

P.S. I have a post on the other Mavericks discussion page noted above but in another account name. I gave up frustrating myself with its OpenID sign-in nonsense and created a direct account here.

permanent link

answered 23 Apr '14, 00:59

pjconmac's gravatar image

pjconmac
11113
accept rate: 0%

The issue is that the libs in wireshark reference X11 libs in /usr/X11/* - in Mavericks this is just a bunch of stubs which will abort your application and tell you to install XQuartz (which you already have). To get around it, one would have to rebuild the whole stack to link against the libs in /opt/X11 instead. I used the following trick to get around it: http://superuser.com/a/650933

(The Qt version still requires a bit of tweaking before I'd be ready to switch.)

(08 May '14, 03:32) mstorsjo

Installing XQuartz doesn't point those stubs at /opt? That's really annoying - if you're going to have stubs for not-present software that says "hey, would you like to install XXX?", installing XXX should replace the stubs. Apple's command-line tools do that, and so do at least some command-line tools on Debian and relatives.

For what it's worth, on my Mavericks VM, with XQuartz installed, /usr/X11 is a symlink to /opt/X11.

(Also, for what it's worth, on my Mountain Lion main machine, Safari thinks "XQuartz" and "Xquartz" are both misspellings. :-))

(08 May '14, 16:52) Guy Harris ♦♦

At the moment, as I mentioned I have the Qt version of Wireshark installed. After reading these two comments I opened a Terminal session. I 'cd' into '/usr/X11' did a listing, 'cd' into subdirectory 'lib' and did a listing and copied the screen output to a text editor window (in BBEdit.) I cleared the screen and did the same for '/opt/X11' and its 'lib' subdirectory.

date; cd /opt/X11/; ls -l; cd lib; ls -l

date; cd /usr/X11/; ls -l; cd lib; ls -l

Then, I did a compare on the two file lists. They are the same. Is this because of the Qt-version? Am I missing something? I can do an uninstall of XQuartz and Wireshark and do this routine again. Thoughts?

(08 May '14, 17:10) pjconmac

Then, I did a compare on the two file lists. They are the same

Try ls -ld /usr/X11. If it reports something such as

lrwxr-xr-x  1 root  wheel  8 Sep  7  2012 /usr/X11 -> /opt/X11

then the file lists are the same because the directories are the same - /usr/X11, in that case, is just a symlink to /opt/X11.

Is this because of the Qt-version?

No. The Qt version does not use X11 on OS X.

(08 May '14, 17:19) Guy Harris ♦♦

Ah, so it is... I missed that detail:

lrwxr-xr-x 1 root wheel 8 14 Nov 12:27 /usr/[email protected] -> /opt/X11

(08 May '14, 17:23) pjconmac

To follow up - I reinstalled XQuartz 2.7.5 and then I got the /usr/X11 symlink set up as others had it. (In my case, I had installed XQuartz 2.7.5 before upgrading to Mavericks, and previously didn't realize that reinstalling it would help.)

(11 May '14, 13:01) mstorsjo
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×157
×108
×18

question asked: 15 Apr '14, 02:19

question was seen: 7,283 times

last updated: 11 May '14, 13:01

p​o​w​e​r​e​d by O​S​Q​A