This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Unable to capture en0 on Mac

0

Hi all,

I've tried changing permissions but I don't think that's the problem I have. I'm quite new to WireShark and am very much stumped by this. When I install WireShark and load it up, I see the following capture options: awdl0, thunderbolt bridge: bridge0, utun0, p2p0 and lookback io0. Basically, no en0. Yet when I go to capture>options>manage interfaces, I can see en0 and others, yet it won't let me tick the box which says show.

Any advance would be appreciated.

So pictures are here;

  1. The wireshark opening screen:alt text
  2. Capture>options: alt text
  3. Capture>options>manage interfaces: alt text

I am unable to tick the box in for en0 in 3)

asked 03 Jan '16, 04:36

Blake's gravatar image

Blake
6113
accept rate: 0%

edited 06 Jan '16, 08:17

grahamb's gravatar image

grahamb ♦
19.8k330206

When I install WireShark and load it up, I see the following capture options: awdl0, thunderbolt bridge: bridge0, utun0, p2p0 and lookback io0. Basically, no en0.

Is that on the main screen, or on the Capture->Options list, or both?

(03 Jan '16, 15:23) Guy Harris ♦♦

Both, but if I go into capture>options>manage interfaces, I can see en0.

(04 Jan '16, 09:26) Blake

Do either of the two lists of interfaces allow you to scroll them? If so, and you scroll them to find the end of the list, is en0 at the end of the list?

(04 Jan '16, 17:27) Guy Harris ♦♦

Yet when I go to capture>options>manage interfaces, I can see en0 and others, yet it won't let me tick the box which says show.

Could you paste a screenshot of that?

(05 Jan '16, 13:27) Christian_R

Sure. Uploaded pictures in my original post. Many thanks for any help here.

(06 Jan '16, 08:05) Blake

To Guy Harris: Scrolling doesn't help as my list of interfaces isn't that large. I've uploaded some pictures to make it clearer.

(06 Jan '16, 08:06) Blake

What do the commands ifconfig -a and tcpdump -D print?

(06 Jan '16, 10:00) Guy Harris ♦♦

Are you able to capture in command line? Is "en0" listed in the command "/Applications/Wireshark\ 2.0.1rc0.app/Contents/MacOS/tshark -D"? Can you show us the result of: ls -als /dev/bpf0 ls -als /dev/bpf1 ls -als /dev/bpf2 ls -als /dev/bpf3

(07 Jan '16, 06:14) TomLaBaude
showing 5 of 8 show 3 more comments

One Answer:

0

It is the same like my system. You have to do the following steps:

  1. Click into the checkbox for the en0 Interface shown in screenshot 3.
  2. Click the OK button in screenshot 3
  3. After that you should be able to use the interface en0.

Remark: As I can see in your screenshots the interface en0 is set to "not show". The checkmark is nearly white coloured as you can see at the interface lo0.

answered 06 Jan '16, 09:18

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

Also in the remarks:

I am unable to tick the box in for en0 in 3)
(06 Jan '16, 09:24) grahamb ♦

@Grahamb: I had the same feeling while I have tested it.

(06 Jan '16, 09:44) Christian_R