Capturing USB traffic in macOS Catalina

asked 2019-10-23 20:42:52 +0000

dcol1340
1 ●1 ●1 ●1

Hi guys,

Found an earlier post about opening USB interfaces in wireshark (https://stackoverflow.com/questions/1...).

However, it seems that in macOS Catalina this is not possible as when running the ifconfig to pull the USB interface up it gives: ifconfig: interface HSO20 does not exist

Has anyone found a way around this? My tcpdump -D is here showing the interfaces:

1.en0 [Up, Running]
2.p2p0 [Up, Running]
3.bridge0 [Up, Running]
4.awdl0 [Up, Running]
5.llw0 [Up, Running]
6.utun0 [Up, Running]
7.vboxnet0 [Up, Running]
8.en1 [Up, Running]
9.utun1 [Up, Running]
10.en2 [Up, Running]
11.utun2 [Up, Running]
12.utun3 [Up, Running]
13.lo0 [Up, Running, Loopback]
14.gif0
15.stf0

Thanks David

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2019-10-31 20:45:56 +0000

Guy Harris
19890 ●3 ●633 ●207

Apple's resident Captain Lockdowns appear to require that you disable System Integrity Protection to capture USB traffic on Catalina.

edit flag offensive delete link

Comments

Unfortunately, after disabling SIP the problem still exists where Wireshark will no longer recognize my USB C Ethernet adapter ONLY after updating to macOS 10.15.2 Catalina (that specific update, not the previous Catalina version).

What isnt working: Wireshark recognizing usb interface after updating macOS to 10.15.2 Catalina.

What am I using: MacBook Pro (13-inch, 2017, Two Thunderbolt 3 ports) on 10.15.2

What I tried: Disabled SIP from recovery mode > terminal > csrutil disable > enter > restart > launch Wireshark

mblend27 ( 2019-12-19 10:04:30 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-10-23 20:42:52 +0000

Seen: 3,691 times

Last updated: Oct 31 '19

Capturing USB traffic in macOS Catalina edit