I am trying to run Wireshark on Mac OS X in the background. I installed the command line utilities, and so I am able to start Wireshark and capture packets using the command line.

The only thing I want now is to run it in the background, without the X11 icon in the Dock or seeing Wireshark's window. I believe it is possible, but can't find anything in Wireshark's docs.

Maybe another approach would be to hide the icon?

If anybody has already did this or has an idea…

  • BTW - please don't post questions here and at Super User. – Dori Dec 31 '10 at 2:02

As initially seen here:

As far as I remember TShark comes with all distributions of Wireshark. This runs from the command line. The documentation for it is here: http://www.wireshark.org/docs/man-pages/tshark.html

And there's some examples on how to use it here: http://www.codealias.info/technotes/the_tshark_capture_and_filter_example_page

David Hewitt


There is also a complete alternative in the form of tcpdump, which comes by default on many OS X installs. The syntax is different, but it's command-line only, and is invaluable in a smaller/command line only environment.

It must be run as root, otherwise undo sudo.

| improve this answer | |

As @VxJasonxV said you can use TCPDump and if you don't want the output show on terminal can use >> filename to TCPDump save result on your desired file.

you can use TCPDump with many options but I think this was the best one:

tcpdump -n -v -S -i en1 tcp

en1: interface that you assign IPv4

-v: produce (slightly more) verbose output

-S: Print absolute, rather than relative, TCP sequence numbers.

-n: Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

-i: Listen on interface.

but this save the output that was not readable by human if you want to process the output that was readable by human you must use tshark:

the command that you must use is some thing like this:

tshark -r ~/home/myHome/Desktop/file_name(produce by tcpdump) -R "ip.src==" -T fields -e frame.number -e frame.time -e ip.id -e tcp.window_size -e tcp.analysis.ack_rtt -E header=y > ~/home/myHome/Desktop/file_name.txt
| improve this answer | |

You could run it in screen, or in a virtual X11 session (Xvfb) that is not displaying to your monitor.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .