11

As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.

However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.

How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?

Improve this question
4
  • What kind of wireshark are you running? GUI (app) or command line? – IconDaemon Feb 27 '19 at 12:40
  • Did you login as a standard user or as an administrator user? – jksoegaard Feb 27 '19 at 12:40
  • The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files. – Mark Feb 27 '19 at 20:53
  • @IconDaemon I am talking about GUI app. – scipsycho Feb 28 '19 at 14:16
21

The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.

As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).

If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.

The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.

Improve this answer
6
  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing? – Alexander Feb 28 '19 at 2:23
  • 1
    At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin). – jksoegaard Feb 28 '19 at 6:38
  • I'm a dev, but not a kernel dev. What I was thinking was "does all network traffic have to be piped through these devices, so that it could be intercepted for logging by wireshark, whether wireshark is actually capturing or not?"? – Alexander Feb 28 '19 at 17:29
  • No, it doesn't work like that at all. – jksoegaard Feb 28 '19 at 17:40
  • 1
    Just open Terminal.app on any Mac and run the command: "man bpf" – jksoegaard Feb 28 '19 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .