Why am I able to open Wireshark and capture packets in macOS without root privileges?How do I open a file as...
What is the purpose of easy combat scenarios that don't need resource expenditure?
Why do neural networks need so many training examples to perform?
How to read 火日参拾月参
Why did Luke use his left hand to shoot?
What are the exceptions to Natural Selection?
Cat is tipping over bed-side lamps during the night
Using only 1s, make 29 with the minimum number of digits
What does it mean for a caliber to be flat shooting?
Why am I able to open Wireshark and capture packets in macOS without root privileges?
Why is it that Bernie Sanders is always called a "socialist"?
Use two 8s and two 3s to make the number 24
What is the wife of a henpecked husband called?
Why was Lupin comfortable with saying Voldemort's name?
Is a new Boolean field better than a null reference when a value can be meaningfully absent?
What would the chemical name be for C13H8Cl3NO
Does Skippy chunky peanut butter contain trans fat?
Is there a weight limit to Feather Fall?
Why would space fleets be aligned?
What would be the rarity of this magic item(s)?
Why exactly do action photographers need high fps burst cameras?
Am I a Rude Number?
Why did Democrats in the Senate oppose the Born-Alive Abortion Survivors Protection Act (2019 S.130)?
How should I handle players who ignore the session zero agreement?
Nested word series [humans only]
Why am I able to open Wireshark and capture packets in macOS without root privileges?
How do I open a file as root in TextEdit on Lion?How do I execute a bash script that requires root privileges?How to open the finder as rootWhy Doesn't OSX root user automatically default to the same shell as other usersiPhone 5S broken screen root access without iTunes authorizationNot able to write a file with rootHow do I protect myself from the root vulnerability in macOS High Sierra?Difference between macOS login root and Darwin Terminal rootHow do I ensure that the macOS root account bug is fully fixed on my machine?Easiest way to definitely, positively delete a file in macOS (10.14+) as root?
As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.
However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.
How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?
root wireshark
edited 30 mins ago
jksoegaard
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
add a comment |
As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.
However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.
How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?
root wireshark
edited 30 mins ago
jksoegaard
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago
add a comment |
As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.
However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.
How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?
root wireshark
edited 30 mins ago
jksoegaard
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.
However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.
How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?
root wireshark
root wireshark
edited 30 mins ago
jksoegaard
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
edited 30 mins ago
jksoegaard
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
edited 30 mins ago
jksoegaard
17.9k1748
edited 30 mins ago
jksoegaard
17.9k1748
edited 30 mins ago
jksoegaard
17.9k1748
17.9k1748
asked 19 hours ago
scipsychoscipsycho
1179
asked 19 hours ago
scipsychoscipsycho
1179
asked 19 hours ago
scipsychoscipsycho
1179
1179
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago
add a comment |
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago
add a comment |
1 Answer
1
active
oldest
votes
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
How do thesebpfdevices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "118"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-and-capture-packets-in-macos-without-root-privil%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
How do thesebpfdevices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
add a comment |
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
How do thesebpfdevices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
add a comment |
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.
As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).
If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.
The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
answered 18 hours ago
jksoegaardjksoegaard
17.9k1748
17.9k1748
How do thesebpfdevices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
add a comment |
How do thesebpfdevices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?
– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
How do these
bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?– Alexander
4 hours ago
How do these
bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?– Alexander
4 hours ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).
– jksoegaard
33 mins ago
add a comment |
Thanks for contributing an answer to Ask Different!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-and-capture-packets-in-macos-without-root-privil%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What kind of wireshark are you running? GUI (app) or command line?
– IconDaemon
18 hours ago
Did you login as a standard user or as an administrator user?
– jksoegaard
18 hours ago
The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.
– Mark
10 hours ago