Why am I able to open Wireshark in macOS X without root privileges?How do I open a file as root in TextEdit...
Why avoid shared user accounts?
Why is Agricola named as such?
Why exactly do action photographers need high fps burst cameras?
What sets the resolution of an analog resistive sensor?
Clues on how to solve these types of problems within 2-3 minutes for competitive exams
A Missing Symbol for This Logo
Line of Bones to Travel and Conform to Curve (Like Train on a Track, Snake...)
How to deal with possible delayed baggage?
Does every functor from Set to Set preserve products?
In mixed effect models, how account for grouped random effects?
How to make ice magic work from a scientific point of view?
How to play electric guitar and bass as a duet
Crontab: Ubuntu running script (noob)
How to use Mathematica to do a complex integrate with poles in real axis?
How would an AI self awareness kill switch work?
If I delete my router's history can my ISP still provide it to my parents?
Non-Cancer terminal illness that can affect young (age 10-13) girls?
How can I get my players to come to the game session after agreeing to a date?
What is the data structure of $@ in shell?
New package vs new version?
How can my powered armor quickly replace its ceramic plates?
How do you catch Smeargle in Pokemon Go?
Words and Words with "ver-" Prefix
Variable is not visible
Why am I able to open Wireshark in macOS X without root privileges?
How do I open a file as root in TextEdit on Lion?Has anyone seen the Lion root account malfunctioning?How do I execute a bash script that requires root privileges?How to open the finder as rootWhy Doesn't OSX root user automatically default to the same shell as other usersiPhone 5S broken screen root access without iTunes authorizationNot able to write a file with rootHow do I protect myself from the root vulnerability in macOS High Sierra?Difference between macOS login root and Darwin Terminal rootEasiest way to definitely, positively delete a file in macOS (10.14+) as root?
As far as I know capturing packets using Wireshark requires root / administrator privileges. In windows, it asks for 'run as administrator' and in ubuntu as well, it asks for authorisation through password, before showing me the interfaces.
However, in macOS X, it is doing neither. Instead, it is directly
showing me the interfaces and then I am able to capture the packets.
Where am I wrong in this?
root wireshark
asked 6 hours ago
scipsychoscipsycho
928
add a comment |
As far as I know capturing packets using Wireshark requires root / administrator privileges. In windows, it asks for 'run as administrator' and in ubuntu as well, it asks for authorisation through password, before showing me the interfaces.
However, in macOS X, it is doing neither. Instead, it is directly
showing me the interfaces and then I am able to capture the packets.
Where am I wrong in this?
root wireshark
asked 6 hours ago
scipsychoscipsycho
928
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago
add a comment |
As far as I know capturing packets using Wireshark requires root / administrator privileges. In windows, it asks for 'run as administrator' and in ubuntu as well, it asks for authorisation through password, before showing me the interfaces.
However, in macOS X, it is doing neither. Instead, it is directly
showing me the interfaces and then I am able to capture the packets.
Where am I wrong in this?
root wireshark
asked 6 hours ago
scipsychoscipsycho
928
As far as I know capturing packets using Wireshark requires root / administrator privileges. In windows, it asks for 'run as administrator' and in ubuntu as well, it asks for authorisation through password, before showing me the interfaces.
However, in macOS X, it is doing neither. Instead, it is directly
showing me the interfaces and then I am able to capture the packets.
Where am I wrong in this?
root wireshark
root wireshark
asked 6 hours ago
scipsychoscipsycho
928
asked 6 hours ago
scipsychoscipsycho
928
asked 6 hours ago
scipsychoscipsycho
928
asked 6 hours ago
scipsychoscipsycho
928
asked 6 hours ago
scipsychoscipsycho
928
928
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago
add a comment |
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago
add a comment |
1 Answer
1
active
oldest
votes
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "118"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-in-macos-x-without-root-privileges%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
add a comment |
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
add a comment |
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
answered 5 hours ago
jksoegaardjksoegaard
17.8k1746
17.8k1746
add a comment |
add a comment |
Thanks for contributing an answer to Ask Different!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-in-macos-x-without-root-privileges%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
5 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
5 hours ago