This is a static archive of our old Q&A Site. Please post any new questions and answers at

on Mac OSX, I can’t capture packets sent over a VPN


TIA - I'm trying to troubleshoot some problems I'm having accessing a particular host over a VPN. I'm running Mac OS/X 10.6.7, and the VPN is a Cisco IPSec VPN. I've verified that the host is routing correctly over the VPN interface (which Mac OS/X calls "utun0"):

dhcp-10-0-0-1:~ joshuadavies$ route get -host route to: destination: gateway: interface: utun0 flags: <up,gateway,host,done,wascloned,proto3,ifscope> recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire 0 0 0 0 0 0 1280 3179

(obviously I've changed the hostname & gateway above).

However, when I fire up Wireshark and listen on interface utun0, even when I connect to a host in the remote network, I don't see anything in the capture list. Is there something special I need to do so that packets sent over a VPN link show up in Wireshark 1.4.6 under Mac OS/X?

asked 29 Jun '11, 08:30

Joshua%20Davies's gravatar image

Joshua Davies
accept rate: 0%


A quick look at xnu/bsd/net/if_utun.c in 10.6.7 indicates that it does include BPF tap code, so it should, in theory, be possible to capture on it with libpcap, so, in theory, both tcpdump and Wireshark should work.

However this mail message indicates that, even if it does support BPF, it might not be getting the traffic you want to see. Is there also, for example, a ppp0 interface that's up? If so, what happens if you try capturing on it?

(29 Jun '11, 12:07) Guy Harris ♦♦

The best thing to do is to report this to The more reports, the more likely it will see attention. I filed 9699332.

(29 Jun '11, 14:19) chrisvire

One Answer:


From Apple,

This is a courtesy email regarding Bug ID# 17265290. 
Engineering has provided the following feedback regarding this issue: 
On OS X, using the tcpdump -i option, you can specify pktap or/and iptap.

I haven't tested this myself, but perhaps that is the solution...

answered 22 Oct '15, 15:22

Nigel%20Sheridan-Smith's gravatar image

Nigel Sherid...
accept rate: 0%

I tired this but it still doesn't seem to capture packet via tunneling interface (utun0). Did you find any other way around?

(04 Feb '16, 10:23) Kjee