12

As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.

However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.

How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?

3
  • What kind of wireshark are you running? GUI (app) or command line?
    – IconDaemon
    Commented Feb 27, 2019 at 12:40
  • Did you login as a standard user or as an administrator user?
    – jksoegaard
    Commented Feb 27, 2019 at 12:40
  • @IconDaemon I am talking about GUI app.
    – scipsycho
    Commented Feb 28, 2019 at 14:16

1 Answer 1

21

The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.

As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).

If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.

The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.

6
  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
    – Alexander
    Commented Feb 28, 2019 at 2:23
  • 1
    At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
    – jksoegaard
    Commented Feb 28, 2019 at 6:38
  • I'm a dev, but not a kernel dev. What I was thinking was "does all network traffic have to be piped through these devices, so that it could be intercepted for logging by wireshark, whether wireshark is actually capturing or not?"?
    – Alexander
    Commented Feb 28, 2019 at 17:29
  • No, it doesn't work like that at all.
    – jksoegaard
    Commented Feb 28, 2019 at 17:40
  • 1
    Just open Terminal.app on any Mac and run the command: "man bpf"
    – jksoegaard
    Commented Feb 28, 2019 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .