Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am trying to run Wireshark on Mac OS X in the background. I installed the command line utilities, and so I am able to start Wireshark and capture packets using the command line.

The only thing I want now is to run it in the background, without the X11 icon in the Dock or seeing Wireshark's window. I believe it is possible, but can't find anything in Wireshark's docs.

Maybe another approach would be to hide the icon?

If anybody has already did this or has an idea…

share|improve this question
    
BTW - please don't post questions here and at Super User. –  Dori Dec 31 '10 at 2:02
add comment

4 Answers 4

As initially seen here:

As far as I remember TShark comes with all distributions of Wireshark. This runs from the command line. The documentation for it is here: http://www.wireshark.org/docs/man-pages/tshark.html

And there's some examples on how to use it here: http://www.codealias.info/technotes/the_tshark_capture_and_filter_example_page

David Hewitt

share|improve this answer
add comment

There is also a complete alternative in the form of tcpdump, which comes by default on many OSX installs. The syntax is different, but it's command-line only, and is invaluable in a smaller/command line only environment.

It must be run as root, otherwise undo sudo.

share|improve this answer
add comment

As @VxJasonxV said you can use TCPDump and if you don't want the output show on terminal can use >> filename to TCPDump save result on your desired file.

you can use TCPDump with many options but I think this was the best one:

tcpdump -n -v -S -i en1 tcp

en1: interface that you assign IPv4

-v: produce (slightly more) verbose output

-S: Print absolute, rather than relative, TCP sequence numbers.

-n: Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

-i: Listen on interface.

but this save the output that was not readable by human if you want to process the output that was readable by human you must use tshark:

the command that you must use is some thing like this:

tshark -r ~/home/myHome/Desktop/file_name(produce by tcpdump) -R "ip.src==172.16.13.128" -T fields -e frame.number -e frame.time -e ip.id -e tcp.window_size -e tcp.analysis.ack_rtt -E header=y > ~/home/myHome/Desktop/file_name.txt
share|improve this answer
add comment

You could run it in screen, or in a virtual X11 session (Xvfb) that is not displaying to your monitor.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.