1

I’m trying to get Wireshark up and running on High Sierra.

When I run

sudo ifconfig XHC20 up

I get:

interface XHC20 does not exist

but then:

tcpdump -D

shows:

 1.p2p0 [Up, Running]
 2.utun0 [Up, Running]
 3.utun1 [Up, Running]
 4.en2 [Up, Running]
 5.lo0 [Up, Running, Loopback]
 6.en0 [Up, Running]
 7.fw0 [Up, Running]
 8.en1 [Up, Running]
 9.UHC26 [Up]
 10.gif0 [none]
 11.stf0 [none]
 12.UHC29 [none]
 13.UHC58 [none]
 14.UHC61 [none]
 15.UHC90 [none]
 16.UHC93 [none]
 17.EHC250 [none]
 18.EHC253 [none]

Is there a generic guide to get any arbitrary version of the wire shark tool running on High Sierra to capture from a USB midi adapter?

Improve this question
3
  • Welcome to Ask Different. Why are you expecting an XHC20 interface to be configured on macOS? (Since en0, en1, en2 are normal ethernet devices) Are you working from a specific version of the tool or a specific install guide? If no one answers, editing these details in the post will let everyone see more details on your issue.
    – bmike ♦
    Aug 20, 2021 at 11:35
  • my apologies. I’m seeking to audit the data coming from and going to a midi control surface connected by USB to my computer. The other network parts are currently irrelevant to me
    – terrrrrran
    Aug 20, 2021 at 11:50
  • I totally missed it, I hope the edits help. This is very specific and practical with that use case called out in the body of the question.
    – bmike ♦
    Aug 20, 2021 at 14:08

2 Answers 2

Reset to default
2

Your computer probably does not have an XHCI controller (i.e. you do not have USB3 for example). Instead use the UHC26 interface for capturing USB packets.

Improve this answer
1
  • Using the tcpdump -D above and then opening System Information I was able to find the exact USB device I wanted to audit. Its address was 0xfd or 253 in hex. That meant that I needed to run sudo ifconfig EHC253 up to get it running in WireShark.
    – terrrrrran
    Aug 23, 2021 at 17:15
0

Got that error too (mindlessly pasted directly from Wireshark's USB Capture Wiki) but in my M1 there's XCH0 and XCH1 instead, I guess they refer to the two USB-C ports. Wireshark USB capturing works when ifconfig upping any of those two (down by default):

% tcpdump -D
1.en0 [Up, Running, Wireless, Associated]
2.awdl0 [Up, Running, Wireless, Associated]
3.llw0 [Up, Running, Wireless, Not associated]
4.utun0 [Up, Running]
5.utun1 [Up, Running]
6.utun2 [Up, Running]
7.lo0 [Up, Running, Loopback]
8.anpi1 [Up, Running, Disconnected]
9.anpi0 [Up, Running, Disconnected]
10.en3 [Up, Running, Disconnected]
11.en4 [Up, Running, Disconnected]
12.en1 [Up, Running, Disconnected]
13.en2 [Up, Running, Disconnected]
14.ap1 [Up, Running, Disconnected]
15.bridge0 [Up, Running, Disconnected]
16.gif0 [none]
17.stf0 [none]
18.XHC1 [none]
19.XHC0 [none]
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .