This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to fix “The capture session could not be initiated” problem?

0

"The capture session could not be initiated on interface 'p2p0' (You don't have permission to capture on that device)."

That's what it says every time I try to start Wireshark. How do I fix this problem?

asked 25 Jun '17, 21:03

Ramiz's gravatar image

Ramiz
3224
accept rate: 0%

edited 25 Jun '17, 23:21

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


3 Answers:

0

Have a look at this question's answers, and come back with more details about your system and steps you've already done if they don't help.

answered 25 Jun '17, 22:05

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 25 Jun '17, 22:05

0

p2p0

That sounds like a macOS interface. If so, when you installed Wireshark, did you install all the components? If not, try re-installing and doing so; one of the components should make it possible for non-root users to capture traffic.

answered 26 Jun '17, 00:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I've tried every possible way, uninstalling Wireshark, restarting, changing connections ect.. yet no results

(26 Jun '17, 00:07) Ramiz

What does ls -l /dev/bpf* print?

(26 Jun '17, 00:18) Guy Harris ♦♦

(26 Jun '17, 00:28) Ramiz

That's not what he asked for. Open a Terminal, and in that window type ls -l /dev/bpf* and share the output with us.

(26 Jun '17, 02:12) Jaap ♦

Open a Terminal, and in that window type ls -l /dev/bpf* and share the output with us.

Which is what "Please check to make sure you have sufficient permissions" means on macOS and *BSD.

(26 Jun '17, 02:22) Guy Harris ♦♦

alt text

(26 Jun '17, 03:01) Ramiz

What happens if you run the command sudo chgrp access_bpf /dev/bpf*?

(26 Jun '17, 11:17) Guy Harris ♦♦

I posted the same screenshot accidentally twice, but when i try sudo chgrp access_bpf /dev/bpf* it asks me for Password after it's done it says ''error has occurred try again''

(26 Jun '17, 23:31) Ramiz

but when i try sudo chgrp access_bpf /dev/bpf* it asks me for Password

At which point you should type your password.

after it's done it says ''error has occurred try again''

"It" meaning sudo?

If what it said was "Sorry, try again.", it means you typed the wrong password.

(27 Jun '17, 00:46) Guy Harris ♦♦

Oh i see, it just says MacBook-Pro:~ newaccountholder$ Which is my Macbook account username

(27 Jun '17, 02:13) Ramiz

alt text

This is what the result was after typing password

(27 Jun '17, 02:15) Ramiz

OK, and now again use ls -l /dev/bpf* and show us the result. Maybe better to copy-paste the text rather than a screenshot. Also, maybe better to "comment" than to "answer".

(27 Jun '17, 02:28) sindy

Obviously, you don't want the extensive help folks are offering for free along with the world's foremost packet analyzer, also for free.

Hopefully you'll edit your "answer" to be more appropriate (and at the same time convert it to a comment to the answer by @Guy Harris as that's what it is)

(28 Jun '17, 21:30) grahamb ♦
showing 5 of 13 show 8 more comments