This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark missing interface - tshark ok

0

I need to capture on en4, a thunderbolt-to-ethernet adapter on OS X 10.11.6. tshark -i en4 and tshark -D work fine for en4, but the en4 interface isn't visible in the wireshark interface list. Permissions and ownership on the /dev/bpf* devices are all the same: crw-rw---- 1 root access_bpf. This is Wireshark Version 2.2.2 (v2.2.2-0-g775fb08), TShark (Wireshark) 2.2.2 (v2.2.2-0-g775fb08) Clue much appreciated! -jah

asked 23 Nov '16, 12:12

jah's gravatar image

jah
6●1●1●3
accept rate: 0%

Did you start Wireshark before, or after, you plugged the adapter into the Mac?

(23 Nov '16, 13:44) Guy Harris ♦♦

After - adapter is plugged in at boot time.
And oddly, tshark & tcpdump see it just fine.

(23 Nov '16, 14:11) jah

Does the command line run with different rights/as a different user than the Wireshark binary?

(23 Nov '16, 15:20) Jasper ♦♦

tshark and wireshark both run as the same user; even starting wireshark as root (sudo start -a wireshark in macland) it still misses en4. Thanks for the thought.

(23 Nov '16, 15:40) jah

Just out of curiosity, what adapter is it?

(24 Nov '16, 01:23) Jaap ♦

It's an Apple thunderbolt-to-Ethernet adapter, "Model A1433 EMC 2590" printed on the plastic.

I can't figure out why the CLI tools would recognize en4, but not wireshark. Does wireshark have a config file that excludes some interfaces or limits their total number to 10?

thx!

(24 Nov '16, 06:43) jah

What does it show when you go into the menu Capture|Options... then click Manage Interfaces... does it show it then?

(24 Nov '16, 07:16) Jaap ♦

Nope. It shows all the same interfaces as tshark -D, except en4. Here's the tshark -D output (with apologies for the formatting):

$ tshark -D
1. en0 (Wi-Fi)
2. awdl0
3. bridge0 (Thunderbolt Bridge)
4. en1 (Thunderbolt 1)
5. en2 (Thunderbolt 2)
6. p2p0
7. en4 (Thunderbolt Ethernet)
8. lo0 (Loopback)
9. cisco (Cisco remote capture)
10. randpkt (Random packet generator)
11. ssh (SSH remote capture)
(24 Nov '16, 08:01) jah
showing 5 of 8 show 3 more comments