Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Unable to remove duplicate serial instances after uninstall

After following the instructions to uninstall Wireshark on my Mac, I am having problems with my serial connection to a microcontroller. The behavior wasn't present prior to installing Wireshark.

Specifically, when I open the USB serial port, a second (duplicate) instance of the port also appears to be active.

The steps I took to install and get Wireshark to work on my Mac (Big Sur 11.3) are as follows:

  1. Installed Wireshark app along with ChmodBPF and "Wireshark to system path" installers.
  2. Disabled my Mac's SIP by setting csrutil disabled while in recovery mode
  3. sudo ifconfig XHC20 up

After those steps, I was able to use Wireshark and XHC20 to successfully capture packets from my USB microcontroller. I then uninstalled Wireshark following the instructions and using the uninstallers. After turning the XHC20 down and re-enabling the Mac's SIP, I am having the problem. Specifically, when I open the USB serial port, a second instance of it comes up and I get this output:

Serial Instance /dev/tty.usbserial-0001 BR: 500000 Opening Serial port: /dev/tty.usbserial-0001 BR: 500000

The duplicate serial instance did not show up prior to Wire shark and my application was working as expected, and now it doesn't. I am attempting to look for remnants of Wireshark in my filesystem as explained in the instructions for manual uninstall but the instructions are not clear on he location of some items:

A. Unload the “org.wireshark.ChmodBPF.plist” launchd job. ----> where is this located?

B. Remove the “access_bpf” group ---> where is this located?

C. /etc/paths.d/Wireshark. ----> can't find such path (including among hidden files)

D. /etc/manpaths.d/Wireshark. ----> can't find such path

How can I remove the duplicate instance of the serial port??

Unable to remove duplicate serial instances after uninstall

After following the instructions to uninstall Wireshark on my Mac, I am having problems with my serial connection to a microcontroller. The behavior wasn't present prior to installing Wireshark.

Specifically, when I open the USB serial port, a second (duplicate) instance of the port also appears to be active.

The steps I took to install and get Wireshark to work on my Mac (Big Sur 11.3) are as follows:

  1. Installed Wireshark app along with ChmodBPF and "Wireshark to system path" installers.
  2. Disabled my Mac's SIP by setting csrutil disabled while in recovery mode
  3. sudo ifconfig XHC20 up

After those steps, I was able to use Wireshark and XHC20 to successfully capture packets from my USB microcontroller. I then uninstalled Wireshark following the instructions and using the uninstallers. After turning the XHC20 down and re-enabling the Mac's SIP, I am having the problem. Specifically, when I open the USB serial port, a second instance of it comes up and I get this output:

Serial Instance /dev/tty.usbserial-0001 BR: 500000 Opening Serial port: /dev/tty.usbserial-0001 BR: 500000

The duplicate serial instance did not show up prior to Wire shark and my application was working as expected, and now it doesn't. I am attempting to look for remnants of Wireshark in my filesystem as explained in the instructions for manual uninstall but the instructions are not clear on he location of some items:

A. Unload the “org.wireshark.ChmodBPF.plist” launchd job. ----> where is this located?

B. Remove the “access_bpf” group ---> where is this located?

C. /etc/paths.d/Wireshark. ----> can't find such path (including among hidden files)

D. /etc/manpaths.d/Wireshark. ----> can't find such path

How can I remove the duplicate instance of the serial port??

References: https://developer.apple.com/forums/thread/95380 https://developer.apple.com/forums/thread/124875 https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40016462