This appears to be a libpcap issue, not a Wireshark issue, given that, in this question, somebody found that Apple's tcpdump, linked with Apple's libpcap, reported "tcpdump: SIOCGIFMEDIA on llw0 failed: Device power is off" for a tcpdump -D
command.
tcpdump -D
and Wireshark's interface list use the same libpcap routine, and that code, at least in the tcpdump.org version of libpcap, will, on macOS, do an SIOCGIFMEDIA on all devices it finds, and give up if it gets an error other than a small set of errors.
That set currently doesn't include EPWROFF ("Device power is off"), so that will cause an attempt to find all devices to fail with that error if that's what device llw0 reports.
I've just checked in a change to tcpdump.org's libpcap to treat EPWROFF as meaning "I don't know if this device is connected" rather than as an error; I have also reported an error to Apple, telling them to pick up that change, as I assume they picked up that code from the tcpdump.org libpcap (they haven't open-sourced their libpcap in a while, so I don't know that for certain). I included a patch for the change made to tcpdump.org's libpcap; if they pick it up for a future Catalina release, that should fix the problem.
It appears, from opensource.apple.com, that 10.15 shipped with libpcap 1.8.1, which did not have the SIOCGIFMEDIA code; 10.15.3 apparently (based on the output of tcpdump --version
) ships with libpcap 1.9.1, which does have the problem. That's why updating to 10.15.2 or 10.15.3 causes the problem to show up.
In any case, it appears that turning the Wi-Fi off can sometimes produce this; it did not do so when I tried it on my MacBook Pro running 10.15.3.
What does "ls -l /dev/bpf*" print?
What does "tcpdump -D" print?
For the bpf* directory search, I get /dev/bpf0 thru /bpf255
For the "tcpdump -D", I get: tcpdump: SIOCGIFMEDIA on llw0 failed: Device power is off
But did all the devices have permissions "rw-rw----", and are they all owned by the "access_bpf" group? If not, that would mean that no interfaces would be shown, not even "lo0".
And did it show "lo0" as an interface, even though it didn't show "en0" or "en1"?
To answer your question, this is what they all show:
That being said, it seems Stig had the answer. Thank you for your interest, tho. Much appreciated.