I'm looking for deep/detailed research into how the MacOS TCP stack works. Namely, what are the files/Dynamic Libraries that offer this service?

What Libraries does WireShark interact with?

My goal is to trace a logical chain of drivers, processes, and configurations that enable a TCP connection to work.

I'll inspect the version of the files, their corresponding default settings, and anything else that can influence their behavior.

My goal is to diagnose the issue described in this question.

1 Answer 1


Wireshark uses the /dev/bpf* devices.

From the Wireshark install readme.txt (describing system modifications):

/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist. A launch daemon that adjusts permissions on the system's packet capture devices (/dev/bpf*) when the system starts up.

The bpfx devices are mechanisms designed to inspect network traffic (i.e. exactly the use case for WireShark).

Or as man bpf says:

The Berkeley Packet Filter provides a raw interface to data link layers in a protocol independent fashion. All packets on the network, even those destined for other hosts, are accessible through this mechanism.

The packet filter appears as a character special device, /dev/bpf. After opening the device, the file descriptor must be bound to a specific network interface with the BIOCSETIF ioctl. A given interface can be shared by multiple listeners, and the filter underlying each descriptor will see an identical packet stream.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .