Wireshark issue with New MacBook Pro

[Mike Savory]

Hi All

Can somebody point me in the correct direction for reporting this.....

I have looked on the Wireshark-user mailing list (which I am just  
joining) but nothing is mentioned.

I just received my new MBP today, and the first thing I did was  
install MP and selfupdate...

Then installed wireshark, everything compiles fine (good job MP team).

The interesting issue is that as soon as I do a   "> sudo tshark -i  
en1"  it kills my wireless association, and I have to reconnect after  
the capture to get back into my Apple Extreme wireless connection,  
all other devices on the network are unaffected.

If I run Wireshark under X it has the same effect.

Running " > sudo tcpdump -i en1  works fine as you would expect.

When running Wireshark the wireless network dies as  soon as you open  
a "List the available Capture Interface" window the wireless  
connection dies. The window shows the interface "wlt1",   "ifconfig"  
shows the en1 as inactive. Performing an actual capture on this  
interface shows the 802.11 beacon frames from my AP.

This is annoying as I often use Wireshark to capture on my en0 while  
remaining connected to my network via en1, but as soon as I open a  
capture dialog, my network connection drops.

Has anyone else seen this on Intel Macs? Or is it perhaps a function  
of the drives for the "Pre-802.11n" Athereos chipset used in the  
newest Macs??

Thanks in advance for any help.

Regards

Mike




On Aug 8, 2006, at 3:00 PM, Eric Hall wrote:

> On Tue, Aug 08, 2006 at 02:33:13PM -0700, Mike Savory wrote:
>>> The Ethereal packet sniffer is changing names and getting a new
>> home....
>>> Wireshark. http://www.wireshark.org/
>>
>> Wireshark 0.99.2 was Released Jul 17, 2006
>>
>> Is anyone looking at upgrading/replacing the current Ethereal port ??
>>
>> The Wireshark 0.99.2 fixes some security issues over the last
>> ethereal 0.99.0, Revision 1 that is in the current portfile.
>>
>> Is there a way of coping with a port that changes name? should there
>> just be a new port for Wireshark. how about invalidating the old
>> ethereal port (with a UI_message to says its been replaced by
>> wireshark....)
>>
>
> 	The wireshark port was added 2 weeks ago....
>
> 	Ethereal will get some sort of notice that wireshark exists,
> haven't decided how that will happen yet.
>
>
> 			-eric
>
>