1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
// Required attributes:
// include-dir
// min-macos-version
include::{include-dir}/attributes.adoc[]
:stylesheet: {include-dir}/ws.css
= Before You Begin
This release of Wireshark requires macOS {min-macos-version} or later.
If you are running an earlier version of macOS you can install using another packaging system such as Homebrew or MacPorts.
== Quick Setup
To install Wireshark, drag the _Wireshark_ application bundle to the _Applications_ folder.
In order to be able to capture packets, install the
link:Wireshark.app/Contents/Resources/Extras/Install%20ChmodBPF.pkg[Install ChmodBPF]
package.
If you would like to add the path to
https://www.wireshark.org/docs/man-pages/wireshark.html[Wireshark],
https://www.wireshark.org/docs/man-pages/tshark.html[TShark],
https://www.wireshark.org/docs/man-pages/capinfos.html[capinfos],
https://www.wireshark.org/docs/man-pages/editcap.html[editcap],
and
https://www.wireshark.org/docs/man-pages/[other command line utilities]
to the system PATH, install the
link:Wireshark.app/Contents/Resources/Extras/Add%20Wireshark%20to%20the%20system%20path.pkg[Add Wireshark to the system path]
package.
== Package Installation Details
The ChmodBPF installer writes to the following locations:
* _/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist_. A launch daemon that adjusts permissions on the system's packet capture devices (/dev/bpf*) when the system starts up.
* _/Library/Application Support/Wireshark/ChmodBPF_. A copy of the launch daemon property list, and the script that the launch daemon runs.
The installer group named “access_bpf” is created. The user who opened the package is added to the group.
The system path installer writes to the following locations:
* _/etc/paths.d/Wireshark_. The folder name in this file is automatically added to PATH
* _/etc/manpaths.d/Wireshark_. The folder name in this file is used by the man command.
It assumes that Wireshark is installed in _/Applications_.
== Uninstalling
To uninstall Wireshark, do the following:
. Remove _/Applications/Wireshark.app_
. Remove _/Library/Application Support/Wireshark_
You can uninstall ChmodBPF via the
link:Wireshark.app/Contents/Resources/Extras/Uninstall%20ChmodBPF.pkg[Uninstall ChmodBPF]
package, which is available on this disk or via menu:Wireshark[About Wireshark,Folders,macOS Extras].
You can also uninstall it manually by doing the following:
. Unload the “org.wireshark.ChmodBPF.plist” launchd job
. Remove _/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist_
. Remove the “access_bpf” group.
You can uninstall the system path components via the
link:Wireshark.app/Contents/Resources/Extras/Remove%20Wireshark%20from%20the%20system%20path.pkg[Remove Wireshark from the system path]
package, which is available on this disk or via menu:Wireshark[About Wireshark,Folders,macOS Extras].
You can also uninstall it manually by doing the following:
. Remove _/etc/paths.d/Wireshark_
. Remove _/etc/manpaths.d/Wireshark_
|
