Remote Capture on Mac

edit

As Jaap noted, there's more involved here than authentication.

The only versions of libpcap I know of that include the rpcap client code are WinPcap and Npcap; the versions provided with various Linux distributions, the *BSDs, macOS, etc. tend not to have the rpcap source compiled in (it's not configured in by default).

As such, you'd need to build libpcap from source with rpcap support enabled, install it, and then build Wireshark from source with that version of libpcap.

If you were to do that, and you want to run the rpcap server with null authentication enabled, you would have to arrange that it run with the -n command-line flag, or set up the rpcapd configuration file with a

NullAuthPermit=YES

line (and, if rpcapd is running, send it a SIGHUP signal with kill -HUP {process-id-of-rpcapd} to get it to reread the configuration file).

Think 'MacOS' not 'Windows' (assuming you're running MacOS, are you?). Then leverage the sshdump extcap interface, rather than fiddling with building your own libpcap (which you would have to do).