Wireshark Failing to Properly Detect Devices Plugged in Via USB-C

asked 2024-11-13 15:41:04 +0000

bayernuard gravatar image

updated 2024-11-13 19:20:38 +0000

I am running Wireshark on a Mac running MacOS Sequoia 15.1, and Wireshark version 4.4.1. Previously (about a month ago), I was able to capture packets from an external mobile device plugged in via a USB-C cable. However, since I updated macOS versions a couple weeks ago, Wireshark has seemingly stopped properly detecting the plugged in mobile devices, instead registering them as Ethernet connections where only ARP packets and the like are captured (previously, all of the mobile device's packets were captured). Listing all the connected devices using Dumpcap, I confirmed that Dumpcap is indeed not properly identifying the plugged in USB-C devices.

Is there anything I can do to resolve this issue? I do not have access to another device that can run Wireshark, but I really need to perform this capture.

Thank you so much in advance for your assistance, and please let me know if there is any additional information I could include that would make troubleshooting this issue easier.

Note that I have taken commonly listed troubleshooting measures, such as disabling System Integrity Protection.

edit retag flag offensive close merge delete

Comments

I have been informed that macOS Sequoia made significant changes to USB handling - is there any way to use the USB capture function properly given these changes, or must I simply turn to another device/operating system?

bayernuard gravatar imagebayernuard ( 2024-11-13 19:16:59 +0000 )edit

I am running Wireshark on a Mac running MacOS Sequoia 15.1, and Wireshark version 4.4.1. Previously (about a month ago), I was able to capture packets from an external mobile device plugged in via a USB-C cable.

What type of mobile device is that?

However, since I updated macOS versions a couple weeks ago,

What did you update it from, and what did you update it to?

Wireshark has seemingly stopped properly detecting the plugged in mobile devices, instead registering them as Ethernet connections where only ARP packets and the like are captured (previously, all of the mobile device's packets were captured).

How were they reported before?

Listing all the connected devices using Dumpcap, I confirmed that Dumpcap is indeed not properly identifying the plugged in USB-C devices.

How did it identify them before, and how does it identify them now?

Note that I have taken ...

(more)
Guy Harris gravatar imageGuy Harris ( 2024-11-13 20:56:36 +0000 )edit