This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm having trouble installing the 1.6.5 Wireshark on a MacBook Pro running OS X 10.7.3. The installer runs but very little is really done. No /Applications/Wireshark created, no /Library/Wireshark created. It did create the /Library/StartupItems/ChmodBPF and did create the BPF devices in /dev. The following are all the messages (note the errors) that appeared in the console during the install process (by double-clicking on the "Wireshark 1.6.5 Intel 64.pkg" file from the mounted "dmg" file that I downloaded):

==================Start of Messages===============================

3/11/12 6:22:37.181 PM Installer: @(#)PROGRAM:Install  PROJECT:Install-686.3

3/11/12 6:22:37.181 PM Installer: @(#)PROGRAM:Installer  PROJECT:Installer-530

3/11/12 6:22:37.181 PM Installer: Hardware: MacBookPro4,1 @ 2.40 GHz (x 2), 6144 MB RAM

3/11/12 6:22:37.182 PM Installer: Running OS Build: Mac OS X 10.7.3 (11D50)

3/11/12 6:22:37.349 PM Installer: Wireshark 1.6.5 Intel 64  Installation Log

3/11/12 6:22:37.349 PM Installer: Opened from: /Volumes/Wireshark/Wireshark 1.6.5 Intel 64.pkg

3/11/12 6:22:48.301 PM Installer: InstallerStatusNotifications plugin loaded

3/11/12 6:23:34.704 PM Installer:
 ================================================================================

3/11/12 6:23:34.704 PM Installer: User picked Standard Install

3/11/12 6:23:34.704 PM Installer: Choices selected for installation:

3/11/12 6:23:34.704 PM Installer:   Install: "Wireshark 1.6.5 Intel 64"

3/11/12 6:23:34.704 PM Installer:   Install: "Wireshark"

3/11/12 6:23:34.704 PM Installer:   Install: "Set capture permissions at startup"

3/11/12 6:23:34.705 PM Installer:   Install: "Command line utilities"

3/11/12 6:23:34.705 PM Installer:  ================================================================================

3/11/12 6:23:35.039 PM Installer: Configuring volume "Bob's MacBook"

3/11/12 6:23:35.053 PM Installer: Free space on "Bob's MacBook": 267.03 GB (267032055808 bytes).

3/11/12 6:23:35.053 PM Installer: Create temporary directory "/var/folders/x0/390xwb6n07g0t1wcg7sw3_zr0000gn/T//Install.1065HvHBbv"

3/11/12 6:23:35.059 PM Installer: IFPKInstallElement (3 packages)

3/11/12 6:23:35.118 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.apple-software

3/11/12 6:23:35.155 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software

3/11/12 6:23:35.191 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software

3/11/12 6:23:35.192 PM com.apple.SecurityServer: Failed to authorize right 'system.install.app-store-software' by client '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd' [1076] for authorization created by '/System/Library/CoreServices/Installer.app' [1065]

3/11/12 6:23:35.200 PM installd: PackageKit: ----- Begin install -----

3/11/12 6:23:38.163 PM installd: Installed "Wireshark 1.6.5 Intel 64" ()

3/11/12 6:23:38.186 PM installd: PackageKit: ----- End install -----

3/11/12 6:23:38.206 PM Installer: Running install actions

3/11/12 6:23:38.209 PM Installer: Removing temporary directory "/var/folders/x0/390xwb6n07g0t1wcg7sw3_zr0000gn/T//Install.1065HvHBbv"

3/11/12 6:23:38.213 PM Installer: Finalize disk "Bob's MacBook"

3/11/12 6:23:38.214 PM Installer: Notifying system of updated components

3/11/12 6:23:38.214 PM Installer: **** Summary Information ****

3/11/12 6:23:38.214 PM Installer:   Operation      Elapsed time

3/11/12 6:23:38.214 PM Installer: -----------------------------

3/11/12 6:23:38.214 PM Installer:        disk      0.01 seconds

3/11/12 6:23:38.214 PM Installer:      script      0.00 seconds

3/11/12 6:23:38.214 PM Installer:        zero      0.03 seconds

3/11/12 6:23:38.214 PM Installer:     install      3.14 seconds

3/11/12 6:23:38.214 PM Installer:     -total-      3.19 seconds

3/11/12 6:23:38.391 PM Installer: IFDInstallController E34A4560 state = 5

3/11/12 6:23:38.391 PM Installer: Displaying 'Install Succeeded' UI.

==================End of Messages===============================

Several things caught my eye:

There are a few errors of note in the console log, even though the installer says the install succeeded. The errors that I noticed were:

3/11/12 6:23:35.118 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.apple-software

3/11/12 6:23:35.155 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software

3/11/12 6:23:35.191 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.app-store-software

3/11/12 6:23:35.192 PM com.apple.SecurityServer: Failed to authorize right 'system.install.app-store-software' by client '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd' [1076] for authorization created by '/System/Library/CoreServices/Installer.app' [1065]

Why is the app-store even involved in this process (Installer.app is not entitled for system.install.app-store-software), as I downloaded the disk image file directly from wireshark.org???

I've had no other problems installing software like this, but have to admit not many are the "pkg" style of installs.

my looking around on this forum has not shown me anyone else having similar problems. I've even tried running the installer from the command line as "root" with no differences, ie it says it worked but nothing appears in the /Applications/Wireshark folder or the /Library/Wireshark folders. I even tried to create these folders before running the install and still no luck.

One thing I did notice from the output of another "installer" command to get a little more info about the package (this doesn't do anything other than look at some details of what is in the package and how it will get installed):

===================Start of installer query command========================

bash-3.2$ installer -verbose -pkginfo -pkg /Volumes/Wireshark/Wireshark\\ 1.6.5\\ Intel\\ 64.pkg

Package information:

Package           : Wireshark 1.6.5 Intel 64
Status            : MetaPackage
Will Restart      : NO
Size              : 82928 KB
Must Authenticate : NO
Title             : Wireshark 1.6.5 Intel 64
Description       : 
Message           : MetaPackage information only, it is not installed

Package           : Wireshark
Status            : Warning
Will Restart      : NO
Size              : 82912 KB
Must Authenticate : YES
Title             : Wireshark
Description       : The main Wireshark application
Message           : The Wireshark network protocol analyzer

Package           : Set capture permissions at startup
Status            : Warning
Will Restart      : NO
Size              : 12 KB
Must Authenticate : YES
Title             : Set capture permissions at startup
Description       : This installs a startup item (ChmodBPF) that changes the group permissions of each BPF device to allow access for the "access_bpf" group. It creates the "access_bpf" group if it doesn't exist and adds the current user to the group.
Message           : Install the ChmodBPF startup item and add an access_bpf group

Package           : Command line utilities
Status            : Warning
Will Restart      : NO
Size              : 4 KB
Must Authenticate : YES
Title             : Command line utilities
Description       : Various utilities associated with Wireshark including TShark, dumpcap, mergecap, capinfos, and editcap.
Message           : Command line utilities associated with Wireshark

====================End of installer query command============================

Notice that the "Must Authenticate" is set to "YES" for the "Wireshark" and "Set capture permissions at startup" and "Command line utilities" packages but not for the first "Wireshark 1.6.5 Intel 64" metapackage. I was asked to authenticate once at the start and assume that this one request is remembered for the 3 packages that need it, so not sure if this is pertinent. Also note that these same three components also have a "Warning" for the Status - I have no idea what that pertains to - any ideas?

Any suggestions on how to get things installed and what problem these errors are really trying to point out?

Thanks very much for your help...

-Bob

asked 11 Mar '12, 19:22

DeepYogurt's gravatar image

DeepYogurt
1111
accept rate: 0%

edited 12 Mar '12, 00:24

grahamb's gravatar image

grahamb ♦
19.8k330206


Hmm. A user had an installation problem with another non-Apple program, with those warnings, as per this forum post. Their problem was that the software kept asking for an activation key even though they entered it each time they tried running it.

The problem may have been that they'd somehow lost their admin privileges (i.e., "admin" was no longer in their default group set), and they fixed the problem this way:

1) Opened up System Preferences -> Users & Groups
2) Created a new, temporary user account with administrator privileges
3) For the current, existing user, I unchecked the "Allow user to administer this computer" box
4) Restarted, & logged in as the new administrator
5) System Preferences -> Users & Groups
6) For the real administrator account, re-checked the "Allow user to administer this computer" box
7) Logged out & logged back in as the actual normal user/administrator
8) Deleted the temporary administrator account
9) Installed Dragonframe

If your account is supposed to have administrative privileges, try going into System Preferences and seeing whether you still have them and, if not, try the above sequence (except with "Dragonframe" replaced by "Wireshark", obviously :-)). If your account isn't supposed to have administrative privileges, try installing Wireshark from an account with administrative privileges, and see whether that works.

In either case, add a comment indicating whether that worked or not.

permanent link

answered 19 Jul '12, 20:51

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Wait, I stand corrected, I didn't read it properly.

3/11/12 6:23:35.118 PM authorizationhost: SFBuiltinEntitled: Installer.app is not entitled for system.install.apple-software

'/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd' [1076] for authorization created by '/System/Library/CoreServices/Installer.app' [1065]

I have read a few articles on this after a few searches. Feel like I owe it to you for my knee-jerk response. There are two recurring suggestions, user accounts and permissions and security signing. Security signing makes sense as it could well be installer.app self checking to make sure it hasn't been tampered with (a potential way to circumvent a large amount of software protection I guess), but this error is borne of the installer, whether through wireshark (unlikely because as I said I've seen it before when installing Logic) or installer.app itself.

I suggest repairing permissions, then removing your Admin rights, restarting then and reinstating them.

permanent link

answered 19 Jul '12, 21:03

GenZ's gravatar image

GenZ
0
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×157
×58
×17
×13

question asked: 11 Mar '12, 19:22

question was seen: 4,625 times

last updated: 19 Jul '12, 21:03

p​o​w​e​r​e​d by O​S​Q​A