Cant capture packets on Macbook M1

asked 2023-01-08 02:30:05 +0000

NTEng
1 ●1 ●1 ●1

Hey,

So I got MacBook M1 and having trouble in starting packet captures. Wireshark requires "ChmodBPF" package which I have installed but still having issues with it.

Can someone please help as without the ability of capturing packets, the tool is not much of a use :(

I am surprised that on MacBook its having issues.

edit retag flag offensive close merge delete

Comments

I am having trouble installing ChmodBPF, how do i do this exactly as the installer doesn't seem to work?

Andythetallguy ( 2023-02-06 21:28:39 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2024-12-09 20:27:50 +0000

juniore
1 ●1

updated 2024-12-09 20:28:10 +0000

I just found a solution, running Sequoia on M1. In order to see packets, you have to disable Monitor mode. I you want to use Monitor mode, for example to see 802.11 packets, yo need first to disconnect from any Wifi Network, then you start seing the packets.

edit flag offensive delete link

add a comment

answered 2023-01-10 15:51:08 +0000

brentalanmiller
1

Are you running Ventura? This worked for me https://ask.wireshark.org/question/29...

edit flag offensive delete link

Comments

Yes Running Venture and the solution you pasted works but once I reboot, it stops working. :(

NTEng ( 2023-01-10 23:12:17 +0000 )edit

ChmodBPF does a UNIX "chmod" command to change the permission bits on all the BPF devices, so that Wireshark (well, Wireshark's dumpcap program) can open them without root privileges. The /dev/bpf files are not stored on a file system that exists after a reboot - the file system is recreated from scratch after a reboot (it's the macOS devfs), so the permission changes are lost after a reboot.

This means that you need to run the ChmodBPF script after every reboot. Wireshark installs it in a fashion that should cause it to be run automatically after every reboot, but something about Ventura 13.1 is causing that not to happen. This is a known issue.

Guy Harris ( 2023-01-12 09:17:12 +0000 )edit

Thank you so much for letting me know.

Much appreciate.

NTEng ( 2023-01-12 09:34:43 +0000 )edit

add a comment