This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I need to capture on en4, a thunderbolt-to-ethernet adapter on OS X 10.11.6. tshark -i en4 and tshark -D work fine for en4, but the en4 interface isn't visible in the wireshark interface list. Permissions and ownership on the /dev/bpf* devices are all the same: crw-rw---- 1 root access_bpf. This is Wireshark Version 2.2.2 (v2.2.2-0-g775fb08), TShark (Wireshark) 2.2.2 (v2.2.2-0-g775fb08) Clue much appreciated! -jah

asked 23 Nov '16, 12:12

jah's gravatar image

jah
6113
accept rate: 0%

Did you start Wireshark before, or after, you plugged the adapter into the Mac?

(23 Nov '16, 13:44) Guy Harris ♦♦

After - adapter is plugged in at boot time.
And oddly, tshark & tcpdump see it just fine.

(23 Nov '16, 14:11) jah

Does the command line run with different rights/as a different user than the Wireshark binary?

(23 Nov '16, 15:20) Jasper ♦♦

tshark and wireshark both run as the same user; even starting wireshark as root (sudo start -a wireshark in macland) it still misses en4. Thanks for the thought.

(23 Nov '16, 15:40) jah

Just out of curiosity, what adapter is it?

(24 Nov '16, 01:23) Jaap ♦

It's an Apple thunderbolt-to-Ethernet adapter, "Model A1433 EMC 2590" printed on the plastic.

I can't figure out why the CLI tools would recognize en4, but not wireshark. Does wireshark have a config file that excludes some interfaces or limits their total number to 10?

thx!

(24 Nov '16, 06:43) jah

What does it show when you go into the menu Capture|Options... then click Manage Interfaces... does it show it then?

(24 Nov '16, 07:16) Jaap ♦

Nope. It shows all the same interfaces as tshark -D, except en4. Here's the tshark -D output (with apologies for the formatting):

$ tshark -D
1. en0 (Wi-Fi)
2. awdl0
3. bridge0 (Thunderbolt Bridge)
4. en1 (Thunderbolt 1)
5. en2 (Thunderbolt 2)
6. p2p0
7. en4 (Thunderbolt Ethernet)
8. lo0 (Loopback)
9. cisco (Cisco remote capture)
10. randpkt (Random packet generator)
11. ssh (SSH remote capture)
(24 Nov '16, 08:01) jah
showing 5 of 8 show 3 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×549
×114

question asked: 23 Nov '16, 12:12

question was seen: 1,502 times

last updated: 24 Nov '16, 09:10

p​o​w​e​r​e​d by O​S​Q​A