This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Open Multiple Captures on Mac

0

Not sure if has been asked before but I failed to find any related from search...

I am wondering if I would open multiple capture files on Mac in Wireshare at the same time? For example, I need to compare the capture done on inside interface of the firewall vs capture done on outside interface.

asked 13 Jul '16, 07:10

m1xed0s's gravatar image

m1xed0s
6112
accept rate: 0%

Spy into my wi fi ..controls everything I want to do.Help me find who this is. Has been going on for many months. Help! At present I am on my I pad

(18 Jul '16, 11:56) Lillian Pitt

One Answer:

1

From the command line you can run

open -n /Applications/Wireshark.app

As its name implies, open opens applications and files, and the -n flag allows you to run multiple instances of applications.

answered 13 Jul '16, 08:30

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
3.3k92258
accept rate: 24%

Is it possible that I double-click on the PCAP files to open Wireshark separately?

(13 Jul '16, 08:48) m1xed0s

Is it possible that I double-click on the PCAP files to open Wireshark separately?

Unfortunately, no. Mac OS X^W^W^WOS X^W^WmacOS prefers that all open files of a given type be handled by a single process, so, if the program that handles a given file type is already running, the Finder will tell it to open a new file. Currently, Wireshark does not support having more than one file open per process, so that doesn't work.

Eventually, we'd like to have a single Wireshark process be able to handle multiple open files, but, given that a lot of code in Wireshark currently has global variables for information about the current file (as in "a lot of dissectors", so it's not just a case of "fix up the Wireshark core and we're done"), doing so would be a big project.

(13 Jul '16, 20:25) Guy Harris ♦♦

Well, most of the apps on mac, even the basic ones like text editor, preview etc, they all can open multiple files in separate windows.

(14 Jul '16, 04:57) m1xed0s

That's certainly true, but it doesn't 1) magically make Wireshark (an application whose GUI code was not originally written for OS X) capable of opening multiple files in separate windows or 2) magically make it a simple change to make it capable of opening multiple files in separate windows. As I said, we'd like to make that possible eventually, but it's a big project.

(14 Jul '16, 09:45) Guy Harris ♦♦

I have no idea how the notification of a new file is sent to the process on OS X, but is it possible for Wireshark to use the notification to start another process with the new file? This might violate some OS X guidelines, but it would help out the users.

(14 Jul '16, 09:52) grahamb ♦