Wireshark Capture support

[Rainer Müller]

On 2010-09-14 12:40 , Jasper Frumau wrote:
> Installed Wireshark a while. Decided to use it for some network analysis
> today, using it for the first time ever. Got an error "There are no
> interfaces on which a capture can be done". I believ I need teh capture
> support driver like wincap for Windows. Which one can I install using
> MacPorts? I searched for packet socket, but nothing. Then I read
> "BSD (including Mac OS X)
> On various BSDs, you need to have BPF support enabled in your kernel. In
> Mac OS X, and in newer versions of at least some free-software BSDs,
> it's enabled by default. In other BSDs, see the documentation for your
> system for information on how to enable BPF support.  "

You need to run wireshark with extended privileges in order to be able
to read "raw" from the capture interface. /dev/bpf* is only accessible
for root by default. Run 'sudo wireshark'.

I don't know if modifying the permissions on those files would help as
described on the wireshark wiki here:
<http://wiki.wireshark.org/CaptureSetup/CapturePrivileges> (BSD section)

HTH,
Rainer