Why am I able to open Wireshark and capture packets in macOS without root privileges?












8















As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.



However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.



How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?










share|improve this question

























  • What kind of wireshark are you running? GUI (app) or command line?

    – IconDaemon
    18 hours ago











  • Did you login as a standard user or as an administrator user?

    – jksoegaard
    18 hours ago











  • The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

    – Mark
    10 hours ago
















8















As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.



However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.



How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?










share|improve this question

























  • What kind of wireshark are you running? GUI (app) or command line?

    – IconDaemon
    18 hours ago











  • Did you login as a standard user or as an administrator user?

    – jksoegaard
    18 hours ago











  • The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

    – Mark
    10 hours ago














8












8








8


1






As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.



However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.



How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?










share|improve this question
















As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.



However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.



How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?







root wireshark






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 30 mins ago









jksoegaard

17.9k1748




17.9k1748










asked 19 hours ago









scipsychoscipsycho

1179




1179













  • What kind of wireshark are you running? GUI (app) or command line?

    – IconDaemon
    18 hours ago











  • Did you login as a standard user or as an administrator user?

    – jksoegaard
    18 hours ago











  • The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

    – Mark
    10 hours ago



















  • What kind of wireshark are you running? GUI (app) or command line?

    – IconDaemon
    18 hours ago











  • Did you login as a standard user or as an administrator user?

    – jksoegaard
    18 hours ago











  • The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

    – Mark
    10 hours ago

















What kind of wireshark are you running? GUI (app) or command line?

– IconDaemon
18 hours ago





What kind of wireshark are you running? GUI (app) or command line?

– IconDaemon
18 hours ago













Did you login as a standard user or as an administrator user?

– jksoegaard
18 hours ago





Did you login as a standard user or as an administrator user?

– jksoegaard
18 hours ago













The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

– Mark
10 hours ago





The question in the title and the question in the body of your post aren't the same. The reason why you can open Wireshark without root privileges is because you can use it to analyze packet dumps, which are just ordinary files.

– Mark
10 hours ago










1 Answer
1






active

oldest

votes


















14














The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.



As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).



If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.



The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.






share|improve this answer
























  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

    – Alexander
    4 hours ago











  • At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

    – jksoegaard
    34 mins ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "118"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-and-capture-packets-in-macos-without-root-privil%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









14














The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.



As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).



If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.



The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.






share|improve this answer
























  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

    – Alexander
    4 hours ago











  • At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

    – jksoegaard
    34 mins ago
















14














The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.



As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).



If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.



The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.






share|improve this answer
























  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

    – Alexander
    4 hours ago











  • At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

    – jksoegaard
    34 mins ago














14












14








14







The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.



As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).



If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.



The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.






share|improve this answer













The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.



As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).



If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.



The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.







share|improve this answer












share|improve this answer



share|improve this answer










answered 18 hours ago









jksoegaardjksoegaard

17.9k1748




17.9k1748













  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

    – Alexander
    4 hours ago











  • At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

    – jksoegaard
    34 mins ago



















  • How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

    – Alexander
    4 hours ago











  • At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

    – jksoegaard
    34 mins ago

















How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

– Alexander
4 hours ago





How do these bpf devices work exactly? Does this imply there' a performance-cost to having wireshark installed, even when not capturing?

– Alexander
4 hours ago













At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

– jksoegaard
34 mins ago





At what level do you want the explanation? (I.e. are you home user, programmer, kernel developer?). In general terms they work like any other device. A program reads from the device and receives data. In this case the data is network packets. The program uses ioctl() to configure which NIC to listen on, set packet filters, etc. BPF is a common system which is also available on other systems like FreeBSD, Linux, etc. It does not mean that there’s a performance cost to having Wireshark installed. BPF is not a part of Wireshark, it is a standard part of the macOS kernel (Darwin).

– jksoegaard
34 mins ago


















draft saved

draft discarded




















































Thanks for contributing an answer to Ask Different!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f352593%2fwhy-am-i-able-to-open-wireshark-and-capture-packets-in-macos-without-root-privil%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Knooppunt Holsloot

Altaar (religie)

Gregoriusmis