37

Does anyone know what the "access_bpf" group is / does. I noticed it when I went into Preferences > Users & Groups.

I've searched around and found that it has something to do with Wireshark, however I have not installed the program on my Mac so I'm too sure how the group got added.

Improve this question
1
  • 2
    good search :) the Wireshark is the one making that Group. Since you do not remember installing it it might have been someone else.
    – Ruskes
    Jul 12, 2014 at 9:32

5 Answers 5

Reset to default
35

Wireshark's installer configures your system so that the user doing the installation can capture network traffic without the capturing program having to run as root.

The way it does this is to:

  • create an access_bpf group;
  • put the user into that group;
  • install a StartupItem (in older versions) or a launch daemon (in newer versions) that, when the system is booted, changes the permissions of the BPF devices to rw-rw--- and the group owner of the BPF devices to access_bpf;
  • arranges that the StartupItem/launch daemon run at that time.

Note, BTW, that this also allows you to capture traffic with Wireshark (or Wireshark's TShark or dumpcap programs) without having to run them as root, it also allows you to capture traffic with tcpdump without having to run it as root.

Improve this answer
11

The Installer for Wireshark will create the access_bpf group! or in your case who knows :)

Since you do not remember installing and do not use it then just remove it.

To remove Wireshark from your machine, look for following files on your Mac and remove them if they exist:

sudo rm -r /Applications/Wireshark.app
sudo rm -r /Library/Wireshark
sudo rm /Library/StartupItems/ChmodBPF
sudo rm /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist
sudo rm /Library/Application\ Support/Wireshark/ChmodBPF/ChmodBF
sudo rm /Library/Application\ Support/Wireshark/ChmodBPF/org.wireshark.ChmodBPF.plist

Also remove the access_bpf group

Improve this answer
10

Navigate to System Preferences -> Users & Groups -> Unlock it as Admin -> open the field Groups under Users -> select and delete.

Or via terminal with

sudo dscl . -delete /Groups/access_bpf
Improve this answer
2
  • Yes, but you did not answer the question, i.e. what is that group for... Others did though.
    – Motti Shneor
    Jul 18, 2018 at 7:20
  • You are right. It should have been a comment to the way of deleting, not an answer. Anyway, my original post mentioned it was an answer to a previous poster, but it has been edited a lot, and twice. Making it clearer, though.
    – leon
    Jul 18, 2018 at 22:06
1

This also could be the remnants of you were hit with a java drive by malware attack.

In this case, a bot will gain root access, create a guest account (perhaps hidden well) and start looking at your keychains..

if you see mitmproxy under certs, call apple or another trusted support contact immediately.

they've talked to me over the phone as if they've never heard of the issue.

the fact still stands that MacOS is not perfect. if you still need help, feel free to write.

Improve this answer
1
  • 1
    Thanis for answering. Malware often disguises things with common or expected names. I edited a bit. You might consider the “they haven’t heard” report. Of course professional support isn’t going to disclose other people’s reports to you, they focus on your problem and yours alone. As you’ve shown, any one sentence they say will often be posted publicly without the context of a longer conversation, so they also try to stick to the facts knowing they might be on the front page of Reddit tomorrow.
    – bmike ♦
    Feb 6, 2019 at 11:07
1

This group will also be created by installing Debookee, a macOS-native network traffic analyzer tool, which uses an embedded Wireshark.

https://debookee.com

Improve this answer
1
  • Can confirm this solution. Not having Wireshark installed, I removed access_bpf group BEFORE reading this post. Tried to run Debokee (which I had istalled) and complained not finding wireshark access_bpf. Reinstalled it from scratch to be sure. Solved.
    – Lippoli
    Sep 18, 2021 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .