Wireshark · Wireshark-dev: Re: [Wireshark-dev] WireShark on MAC OS X Leopard 10.5.7

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 2, 2009, at 12:01 AM, Ed Wagner wrote:

> I tried Wireshark on my home Apple Intel IMAC using Leopard 10.5.7  
> and found that I could not capture anything as an administrator. The  
> interfaces did not show up, and I saw an error stating that  
> permission on /dev/bpf0 was denied. Apparently this program must be  
> run as root because the permissions on thios file are crw-------  
> root wheel. However, MAC OS X does not have a RunAs command like  
> Windows does

No; instead, it has an "sudo" command like many other UN*Xes do. :-)

One thing you can do with "sudo" is

	sudo chgrp admin /dev/bpf*
	sudo chmod g+w /dev/bpf*

which gives everybody in the group "admin" - i.e., all administrative  
users - read and write permission on the BPF devices.

That won't persist across a reboot, so you'd have to install a startup  
item or a launchd daemon to do that at boot time; the Wireshark .dmg  
has a startup item you can install to do that.