05-11-2009, 07:18 PM

Hello,

I am relatively new to Apple and have a Mac Book running OS X 10.5 Leopard. I had installed Wire Shark but am having some problems getting my interface to become visible. When I look under the capture settings I am not able to see any interfaces. I am not sure what exactly it is that I have done wrong but I simple downloaded the file and dragged it to the Applications Folder. I read somewhere that I may need something called Mac Ports and I did install it but am not sure what to do with it. Anyways, I would really appreciate the help if someone is able to.
Below is the error message I get when starting the Wire Shark Application. I wanted to also have a terminal based network scanner like ‘tshark’ on Linux but I guess that is a separate issue, would really like to get this working if possible.

 The following errors were found while loading the MIBS:
-:0 1 module-not-found failed to locate MIB module `IP-MIB'
-:0 1 module-not-found failed to locate MIB module `IF-MIB'
-:0 1 module-not-found failed to locate MIB module `TCP-MIB'
-:0 1 module-not-found failed to locate MIB module `UDP-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMPv2-MIB'
-:0 1 module-not-found failed to locate MIB module `RFC1213-MIB'
-:0 1 module-not-found failed to locate MIB module `IPV6-ICMP-MIB'
-:0 1 module-not-found failed to locate MIB module `IPV6-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-COMMUNITY-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-FRAMEWORK-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-MPD-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-NOTIFICATION-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-PROXY-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-TARGET-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-USER-BASED-SM-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-USM-DH-OBJECTS-MIB'
-:0 1 module-not-found failed to locate MIB module `SNMP-VIEW-BASED-ACM-MIB'

The Current Path is: /usr/local/share/mibs/ietf:/usr/local/share/mibs/iana:/usr/local/share/mibs/irtf:/usr/local/share/mibs/site:/usr/local/share/mibs/tubs:/usr/local/share/pibs/ietf:/usr/local/share/pibs/site:/usr/local/share/pibs/tubs

Many thanks in advance for any advice.

Regards,

Max

05-17-2009, 07:44 AM

The status message you are seeing about the MIB's have nothing to do with the interface issue. Wireshark requires that you (the user running Wireshark) be the owner of the /dev/bpf* (or at the very least have permissions to use it) devices.

Easiest thing to do is simply

chown <user-name> /dev/bpf*

Fire up Wireshark and you should see the interfaces just fine.

Note, Wireshark comes with a script to allow you to do this on startup.

05-17-2009, 02:19 PM

Thank you, this really helps, I will give it a try. Do you by any change know where I can find this script so that I dont have to run that command every time. Do you need to download it separately. Thank you.

Max

05-22-2009, 07:48 AM

The script should come as part of the bundle you download. Wireshark comes with a README file, the location and use of the script should be in there.

05-25-2009, 02:43 AM

Thank you. I will check it out. Sorry forgot to subscribe to this thread otherwise I would have replied sooner. Thanks for your help.

Max

05-25-2009, 05:56 PM

I'm having this same problem, but for some reason I can't get it to work for me. I've put the file Startup in my /Libray/StartupItems folder, run chown <shortname> /dev/bpf* , and also run the script in the start up folder that comes with Wireshark. Might you know what I'm doing wrong?

Edit: I got it to work, sorry. I did sudo chown <shortname> /dev/bpf*
Did I do the right thing with the script? I put the .plist and the text file in the startup folder also. Is that right?

05-26-2009, 12:43 AM

Login as an admin user and try it.

06-23-2009, 12:35 PM

I'm getting the same errors as Max Avion. I was using Wireshark 1.0 with no problems. After downloading 1.2, I removed the Wireshark icon from Applications and deleted the Wireshark folder from Startup. (This folder contains a shell script that simply does a chmod 644 /dev/bpf* so it seems to be the "old" version of ChmodBPF.)

Then I installed the new Wireshark per the readme, and moved the ChmodBPF folder to Startup as directed.
After a reboot, I get the following:

Last login: Tue Jun 23 10:29:33 on console
TestComputer:~ walts$ ls -l /dev/bpf*
crw-rw----  1 root  admin   23,   0 Jun 23 12:26 /dev/bpf0
crw-rw----  1 root  admin   23,   1 Jun 23 12:26 /dev/bpf1
crw-rw----  1 root  admin   23,   2 Jun 23 10:28 /dev/bpf2
crw-rw----  1 root  admin   23,   3 Jun 23 10:28 /dev/bpf3
TestComputer:~ walts$

which sounds right based on the readme. Even so, I keep getting the exact error messages Max was getting in the first post when I try to run Wireshark.

I don't understand the Path statement in the error message. As far as I can tell, my path is:

PATH=/usr/local/mysql/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin

and the Command Line contents (not the folder itself) is in /usr/local/bin.

Any help would be welcome!

Walt

04-16-2011, 12:14 AM

I had this problem while installing on a new mac and this thread helped.
Admin issues?
Try
sudo chown <user-name> /dev/bpf*

with <user-name> being your user name without the < or >