Ask Your Question
0

Uninstalling Wireshark on a Mac

asked 2018-01-29 20:24:06 +0000

anonymous user

Anonymous

How can I uninstall WireShark completely from my Mac? I've been trying to remove my 'customizations' from the program, and uninstalling seemed to be the most effective option, but I can't even figure out how to uninstall. Any help would be appreciated!

edit retag flag offensive close merge delete

Comments

How do you uninstall any other program from a Mac? What makes this different?

Jaap gravatar imageJaap ( 2018-01-30 16:57:07 +0000 )edit

Usually you simply drag the application icon out of the 'Applications' folder and into the trash. However, this does not completely uninstall your support files. So files like the user preferences that I mentioned in my post remain and are used (again) whenever you reinstall the program.

8cody gravatar image8cody ( 2018-01-30 18:01:28 +0000 )edit

However, this does not completely uninstall your support files.

That's true of most if not all applications for macOS; it's not unique to Wireshark. Only stuff in the app bundle go into the trash; nothing under your home directory, such as preferences, go away.

Guy Harris gravatar imageGuy Harris ( 2023-04-20 11:09:20 +0000 )edit

3 Answers

Sort by » oldest newest most voted
0

answered 2023-04-20 08:23:30 +0000

Guy Harris gravatar image

I've been trying to remove my 'customizations' from the program, and uninstalling seemed to be the most effective option

Not necessarily.

If you customizations are just changes made in, for example, Wireshark > Preferences, those changes will, on UN*Xes (including macOS), be in ~/.config/wireshark, as Jaap said. Dragging the Wireshark app to the trash will not remove those, and the Read me first.html instructions won't remove them, either. What you should do in that case is, as per Jaap's answer, should be to remove that directory. (Quit Wireshark first before doing that.)

That can be done in a Terminal window by doing rm -rf ~/.config/wireshark; doing it from the Finder is a bit more work - you'd have to open a Finder window, point it to your home directory (that should appear in the sidebar on the left, with an icon of a house and your login name next to it), click Command-Shift-. (that's the Command key, the Shift key, and the "greater than/period" key). There should be a ".config" folder (somewhat faded out, to indicate that it's a normally-hidden file/folder) near the top; double-click it. There should be a "wireshark" folder (no, not capital-W); just drag that to the Trash. Then click Command-Shift-. again (unless you want to continue to see hidden files and folders in the Finder). You'll be able to start up Wireshark again after that; it should start up without your customizations.

If those aren't all of your customizations - for example, if you modified files in /Applications/Wireshark or added files under /Applications/Wireshark - then removing Wireshark would remove those customizations (but not the preference customizations).

edit flag offensive delete link more
0

answered 2023-04-19 14:35:39 +0000

The instructions for uninstalling can be found in the Read me first.html file found within the Wireshark installation package. Here is the text of the relevant section of that document from the installer package for version 4.0.5:

Uninstalling

To uninstall Wireshark, do the following:

  1. Remove /Applications/Wireshark.app

  2. Remove /Library/Application Support/Wireshark

You can uninstall ChmodBPF via the Uninstall ChmodBPF package, which is available on this disk or via Wireshark › About Wireshark › Folders › macOS Extras. You can also uninstall it manually by doing the following:

  1. Unload the “org.wireshark.ChmodBPF.plist” launchd job

  2. Remove /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist

  3. Remove the “access_bpf” group.

You can uninstall the system path components via the Remove Wireshark from the system path package, which is available on this disk or via Wireshark › About Wireshark › Folders › macOS Extras. You can also uninstall it manually by doing the following:

  1. Remove /etc/paths.d/Wireshark

  2. Remove /etc/manpaths.d/Wireshark

edit flag offensive delete link more
0

answered 2018-01-30 18:53:59 +0000

Jaap gravatar image

Go check out the About Wireshark dialog. It has a Folders tab which shows where Wireshark gets its configuration from. Your personal configuration is found in ~/.config/wireshark.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-01-29 20:24:06 +0000

Seen: 1,950 times

Last updated: Apr 20 '23