Kleinsch

IT WORKS thank you.

[...] note: special thanks goes out to Nick Kleinschmidt and Dan Hale for helping out [...]

Yesss!!! Thank you!

For others who will undoubtedly run into the same problem, I’ll make the following note:

The fact that ChmodBPF is failing to set the correct permissions will go unnoticed to the majority of users, because the ““Insecure Startup Item disabled” error, is of course only visible at the command line.

However, at a higher level, the very real and visual problem, that this will solve is that “The wireshark interface list is empty”

That was my problem and it took a little bit of detective work to track down the ultimate culprit. But now everything up and running, thanks again to this tip

Thank you for this tip. It was the last step I needed to get Wireshark working.

Thank you, thank you, thank you!
I can now diagnose my Draytek router when it loses DNS connectivity over Wifi.

Thanks – That’s been bugging me for a while now…

Awesome, thanks!

Good job! Thanks a lot

Thank you so much. This was driving me crazy only being able to get it to work from the command line.

The above commands did not work for me, but this did:

sudo chmod 644 /dev/bpf*

Also, for the StartupParameters.plist files, invoke this from the CLI:

sudo chown -R root:wheel StartupParameters.plist

then restart so that BPF permissions are enabled for Wireshark, or simply
invoke this on the CLI without restarting:

sudo SystemStarter start ChmodBPF

many thx
for the command to
gettnig it work !!!

Thank you so much. This was driving me crazy only being able to get it to work from the command line.

I didn’t have any luck with this, I still get the error. ug.

What they said^^ Cheers!!

Same as Thomas, still not having any luck. I opened up the command prompt copied the above command
cd /Library/StartupItems
sudo chown -R root:wheel ChmodBPF

It asked me for my password, i entered it, pressed enter then opened up WireShark.
Still no interfaces or capturing devices

I wasn’t very clear on this in the article, but you need to restart your Mac after changing the permissions for the script to work. Adding an update to my post to make sure nobody misses it in the future. I just reinstalled on Mac OS 10.6.4 and everything shows up fine for me after a restart.

Thanks man! Works perfecty!!

I havent to my knowledge installed Wireshark but get the same:”/Library/Startupitems/ChmodBPF” appear at start up, any ideas?

That script could also apply to other packet capturing software you may have installed like libpcap or tcpdump. If you’re not using packet capturing software, you might try moving it out of startup items and restarting, then wait to see what stops working.

thanks a lot!

works, thanks very much.

I’ve been tracking this down for a few hours today … installed Wireshark on a new machine and could not see the interfaces. I ran across several other suggestions that were similar to yours including on wireshark.org, but yours is the only one that worked! Thanks very much for putting this out there … you might want to install a tipjar!

“I wasn’t very clear on this in the article, but you need to restart your Mac after changing the permissions for the script to work.”

No you don’t need to. To check whether the script gets automatically executed, just log out and log in again. Strictly talking, you don’t even need to do that. Just run the script like ‘sudo /Library/StartupItems/ChmodBPF/ChmodBPF start’ to get going.

@whaefelinger
Good call! Thanks for the tip!

[...] Wireshark ChmodBPF errors on Snow Leopard [...]

So a lot of people have been having trouble running Wireshark on OSX 10.6.6, having no interfaces, and when applying the CHmodBPF, they get login errors. Not to fear! Here is how I fixed it. Install Wireshark via Macports, and when starting up Wireshark, run it with “sudo”, so your start command is “sudo wireshark”. Enter password, and all fixed! You don’t even need to keep the CHmodBPF folder in the startupitems folder for it to work.

Happy sniffing!

@Wireshark + OSX 10.6.6 = Success

Sudo is always a magic solution, but it’s not usually a good idea to run lots of programs as root, as there’s potential for lots of damage or malicious activity.

Sorry for being repetitive, but thank you! It worked

[...] has not been started because it does not have the proper security settings.” Thanks to Nick Kleinschmidt’s Blog,  I found how to remedy this. Run the following from Terminal to change the owner of the scripts [...]

Solved my problem. Thank you very much!

@Rob

The command “sudo chown -R root:wheel ChmodBPF” alone did not work for me.

I had to also use (from Rob’s suggestions above):
sudo chmod 644 /dev/bpf*

Thanks to all …..

helpfull!!!

Thanks – you’d think they would have mentioned that in the README…

un-quarantine the file if it as an @ next to it after permissions with ls -al
sudo xattr -r -d com.apple.quarantine /Library/StartupItems/ChmodBPF