I want to setup a wireshark group so I can run it without being root. I tried using the System Preferences tool, Users & Groups, to add a wireshark group but I didn't see anything show up in /etc/group.

Where is the group stored if it's not /etc/group. Do groups set up in User & Groups have any relationship with the chmod/chgrp permissions?

I installed Wireshark via MacPorts and it doesn't currently set the permissions correctly to run as a normal user.

  • I'll answer the groups architecture question, Setting up Wireshark to run as an administrator is all you should need. Why not ask a follow on question explaining how far you've got - and what specific error message or installation guide you followed to obtain and install wire shark. Most people will point you to brew.sh and to run ` brew cask install wireshark-chmodbpf` which sets permissions on the bpf device for you. – bmike Jun 24 '17 at 15:17

That /etc/group file only exists to let the system function in single user boot mode. I wouldn't rely on it for anything other than a possible sanity check for known system groups.

You'll want to use dscl the directory service command line (and associated dsXXX commands to interact with whatever directory services external to the local store) to retrieve group and user information from the database that normal run time changes and lookups happen.

The manual page can get you started and then Apple developer documentation and specific sites (like this one and code posted at GitHub ) might be good places for follow on research and questions on syntax / scripting / usage.

Also - I would install homebrew and see the output from brew info wireshark which details the tool to script setting up a security group and change permissions on the device(s) Wireshark needs to own for capture.

If you're not into that package manager - here's a script that might do the trick.

|improve this answer|||||
  • 1
    I already have MacPorts installed so I don't want to install a second package manager. I actually installed Wireshark through MacPorts but it doesn't set the permissions correctly. I'll look at dscl when I get back to my machine. – Stephen Rasku Jun 24 '17 at 15:34
  • @StephenRasku Fair enough - looks like ports has known about this for 7 years or so - trac.macports.org/ticket/26293 - what I can see is they just assign it to root - see my edit above. – bmike Jun 24 '17 at 16:55
  • That .plist file worked. Thanks. However, I looked at dscl but I couldn't figure out how to do anything. I keep getting "Cannot open remote host, error: DSOpenDirServiceErr". – Stephen Rasku Jun 24 '17 at 20:40
  • @Stephen Rasku Try-dscl /Local/Default -list /Groups PrimaryGroupID. – fd0 Jun 24 '17 at 21:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .