Revision history [back]

In macOS, permission to capture on individual network interfaces means permission to open a /dev/bpf device for reading.

The "ChmodBPF" script Wireshark installs changes the permissions on the BPF devices to be rw-rw---- and the group owner of the BPF devices to be the "access_bpf" group.

This means that any process with "access_bpf" as its primary group or in its secondary group set can do capturing.

Wireshark also puts the user who installs Wireshark into the "access_bpf" group, but it doesn't put any other user into that group. If the user who installs Wireshark isn't an admin user, that means that 1) the user who installs Wireshark has permission to capture and 2) whatever account is the admin user doesn't have permission to capture.

Yes, it means that there is at least one thing that at least one non-admin user can do and that at least one admin user can't do. "An admin user has a superset of the privileges that a non-admin user has" is not guaranteed to be true.

So either:

• run Wireshark from the account that installed it;
• add the "access_bpf" group to the secondary group set of any other account from which you want to run Wireshark;

or both.

As for the hang, that might have the same cause as bug 14284, in which case making sure that all accounts under which you run Wireshark are in the "access_bpf" group should fix that.