WireShark 3.6.21 runs without a problem on Macbook using macOS 10.13.6 High Sierra. It suddenly crashes, but relaunching WireShark causes it to run again without a problem until again a sudden crash. First part of crash report, below. Any help welcome.

Process:               Wireshark 
Path:                  /Applications/Wireshark.app/Contents/MacOS/Wireshark
Identifier:            org.wireshark.Wireshark
Version:               3.6.21 (3.6.21)
Code Type:             X86-64 (Native)
Parent Process:        ??? 
Responsible:           Wireshark 
User ID:               [•]

Date/Time:             2024-03-01 18:39:18.320 +0000
OS Version:            Mac OS X 10.13.6 (17G66)
Report Version:        12
Anonymous UUID:        44A2E51B-8D3D-8570-C840-[•]

Sleep/Wake UUID:       E0492A74-CB88-4709-98B7-[•]

Time Awake Since Boot: 9600 seconds
Time Since Wake:       81 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    DYLD, [0x4] Symbol missing

Application Specific Information:
Wireshark 3.6.21 (v3.6.21-0-gddd4e7d3029f)
 
Compiled (64-bit) using Clang 14.0.3 (clang-1403.0.22.14.1), with Qt 5.15.3,
with libpcap, without POSIX capabilities, with GLib 2.76.6, with zlib 1.2.11,
with Lua 5.2.4, with GnuTLS 3.8.3 and PKCS #11 support, with Gcrypt 1.10.2, with
MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.56.0, with brotli, with
LZ4, with Zstandard, with Snappy, with libxml2 2.11.5, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using Sparkle, with SpeexDSP (using system
library), with Minizip.
 
Running on Mac OS X 10.13.6, build 17G66 (Darwin 17.7.0), with Intel(R) Core(TM)
i7-2720QM CPU @ 2.20GHz (with SSE4.2), with 16384 MB of physical memory, with
GLib 2.76.6, with zlib 1.2.11, with Qt 5.15.3, with libpcap 1.8.1 -- Apple
version 79.20.1, with c-ares 1.19.1, with GnuTLS 3.8.3, with Gcrypt 1.10.2, with
nghttp2 1.56.0, with brotli 1.0.9, with LZ4 1.9.4, with Zstandard 1.5.5, with
libsmi 0.4.8, with LC_TYPE=C, binary plugins supported (0 loaded).
 

Dyld Error Message:
  Symbol not found: ____chkstk_darwin
  Referenced from: /Applications/Wireshark.app/Contents/MacOS/../Frameworks/libgcrypt.20.dylib (which was built for Mac OS X 11.0)
  Expected in: /usr/lib/libSystem.B.dylib

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   dyld                          	0x0000000113d0e24a __abort_with_payload + 10
1   dyld                          	0x0000000113d0dbbc abort_with_payload_wrapper_internal + 89
2   dyld                          	0x0000000113d0dbe9 abort_with_payload + 9
3   dyld                          	0x0000000113ce1482 dyld::halt(char const*) + 354
4   dyld                          	0x0000000113ce15a9 dyld::fastBindLazySymbol(ImageLoader**, unsigned long) + 170
5   libdyld.dylib                 	0x00007fff548d2292 dyld_stub_binder + 282
6   ???                           	0x0000000110dfd2c0 0 + 4578071232
7   libgcrypt.20.dylib            	0x0000000110d6314f _gcry_md_block_write + 351 (hash-common.c:193)
8   libgcrypt.20.dylib            	0x0000000110d5a118 _gcry_md_setkey + 744 (md.c:977)
9   libgcrypt.20.dylib            	0x0000000110d39889 gcry_md_setkey + 89 (visibility.c:1353)
10  libwsutil.13.dylib            	0x000000011101c161 ws_hmac_buffer + 81
11  libwireshark.15.dylib         	0x0000000109256870 dissect_quic + 7488 (packet-quic.c:2423)
12  libwireshark.15.dylib         	0x00000001092578e1 dissect_quic_heur + 529
13  libwireshark.15.dylib         	0x0000000109ac8d4c dissector_try_heuristic + 380 (packet.c:2864)
14  libwireshark.15.dylib         	0x0000000109481009 decode_udp_ports + 905 (packet-udp.c:712)
15  libwireshark.15.dylib         	0x0000000109482e22 dissect + 3810 (packet-udp.c:1267)
16  libwireshark.15.dylib         	0x0000000109481a13 dissect_udp + 19 (packet-udp.c:1274)
17  libwireshark.15.dylib         	0x0000000109ac679c call_dissector_work + 316
18  libwireshark.15.dylib         	0x0000000109ac6612 dissector_try_uint_new + 98 (packet.c:1451)
19  libwireshark.15.dylib         	0x0000000108f444fd ip_try_dissect + 157 (packet-ip.c:1817)
20  libwireshark.15.dylib         	0x0000000108f672bc ipv6_dissect_next + 284 (packet-ipv6.c:2609)
21  libwireshark.15.dylib         	0x0000000108f68389 dissect_ipv6 + 2809 (packet-ipv6.c:2559)
22  libwireshark.15.dylib         	0x0000000109ac679c call_dissector_work + 316
23  libwireshark.15.dylib         	0x0000000109ac6933 dissector_try_uint + 99 (packet.c:1451)
24  libwireshark.15.dylib         	0x0000000108d836a7 dissect_ethertype + 631 (packet-ethertype.c:296)
25  libwireshark.15.dylib         	0x0000000109ac679c call_dissector_work + 316
26  libwireshark.15.dylib         	0x0000000109ac5376 call_dissector_with_data + 38 (packet.c:3284)
27  libwireshark.15.dylib         	0x0000000108d82829 dissect_eth_common + 1449 (packet-eth.c:579)
28  libwireshark.15.dylib         	0x0000000108d82263 dissect_eth + 371 (packet-eth.c:884)
29  libwireshark.15.dylib         	0x0000000109ac679c call_dissector_work + 316
30  libwireshark.15.dylib         	0x0000000108dc3f44 dissect_frame + 6596 (packet-frame.c:938)
31  libwireshark.15.dylib         	0x0000000109ac679c call_dissector_work + 316
32  libwireshark.15.dylib         	0x0000000109ac5376 call_dissector_with_data + 38 (packet.c:3284)
33  libwireshark.15.dylib         	0x0000000109ac5250 dissect_record + 784 (packet.c:626)
34  libwireshark.15.dylib         	0x0000000109ab9f96 epan_dissect_run_with_taps + 70 (epan.c:644)
35  org.wireshark.Wireshark       	0x00000001081cd86d add_packet_to_packet_list + 173
36  org.wireshark.Wireshark       	0x00000001081c7b9d read_record + 413 (file.c:1297)
37  org.wireshark.Wireshark       	0x00000001081c889b cf_continue_tail + 795 (file.c:840)
38  org.wireshark.Wireshark       	0x00000001081cf8d0 capture_input_new_packets + 80 (capture.c:527)
39  org.wireshark.Wireshark       	0x00000001081f3089 sync_pipe_input_cb + 921
40  org.wireshark.Wireshark       	0x0000000107f7dc42 MainWindow::pipeActivated(int) + 50
41  org.qt-project.QtCore         	0x0000000111b7f5ec 0x11195b000 + 2246124
42  org.qt-project.QtCore         	0x0000000111b87dbd QSocketNotifier::event(QEvent*) + 669
43  org.qt-project.QtWidgets      	0x000000011063ac0d QApplicationPrivate::notify_helper(QObject*, QEvent*) + 269
44  org.qt-project.QtWidgets      	0x000000011063bfd2 QApplication::notify(QObject*, QEvent*) + 466
45  org.qt-project.QtCore         	0x0000000111b4d234 QCoreApplication::notifyInternal2(QObject*, QEvent*) + 212
46  org.qt-project.QtCore         	0x0000000111ba1df7 0x11195b000 + 2387447
47  com.apple.CoreFoundation      	0x00007fff2ca39ad8 __CFSocketPerformV0 + 1016
48  com.apple.CoreFoundation      	0x00007fff2ca1ad31 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
49  com.apple.CoreFoundation      	0x00007fff2cad260c __CFRunLoopDoSource0 + 108
50  com.apple.CoreFoundation      	0x00007fff2c9fdce0 __CFRunLoopDoSources0 + 208
51  com.apple.CoreFoundation      	0x00007fff2c9fd15d __CFRunLoopRun + 1293
52  com.apple.CoreFoundation      	0x00007fff2c9fc9b7 CFRunLoopRunSpecific + 487
53  com.apple.HIToolbox           	0x00007fff2bcdcd96 RunCurrentEventLoopInMode + 286
54  com.apple.HIToolbox           	0x00007fff2bcdcb06 ReceiveNextEventCommon + 613
55  com.apple.HIToolbox           	0x00007fff2bcdc884 _BlockUntilNextEventMatchingListInModeWithFilter + 64
56  com.apple.AppKit              	0x00007fff29f8da73 _DPSNextEvent + 2085
57  com.apple.AppKit              	0x00007fff2a723e34 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
58  com.apple.AppKit              	0x00007fff29f82885 -[NSApplication run] + 764
59  libqcocoa.dylib               	0x000000011316883c 0x113130000 + 231484
60  org.qt-project.QtCore         	0x0000000111b493af QEventLoop::exec(QFlags) + 431
61  org.qt-project.QtCore         	0x0000000111b4d7c2 QCoreApplication::exec() + 130
62  org.wireshark.Wireshark       	0x0000000107f46e4d main + 3373
63  libdyld.dylib                 	0x00007fff548d2015 start + 1"

I'm looking for a packet sniffer app that runs on MacOS in a GUI (I know I can accomplish some functionality with native CLI utilities like tcpdump). Previously I used Packet Peeper , however it doesn't seem to run in MacOS 10.14 Mojave (the application opens and seems to run, but no window appears). _* [Other questions](https://apple.stackexchange.com/questions/15928/natively-written-packet-sniffer-inspector-for-os-x) have also mentioned PP as the solution, but they're all fairly old._

Apparently, Apple Wireless Direct Link is a Wi-Fi-like, unencrypted proprietary Apple protocol used by AirDrop, AirPlay, Apple Watch, Game Center, and Sidecar. I’d like to see what data it’s transmitting. So, how do I monitor AWDL packets to and from my macOS computer (macOS Sequoia 15.1.1 on an iMac 24”)? There’s an entry for the awdl0 interface in Wireshark 4.4.2 for macOS, but it doesn’t seem to capture anything.

My router (Unifi UDM-SE) has a honeypot configured which is capturing a scan from the iPhone about twice per day. I would like to figure out which App is doing this. I have followed the instructions on this post (https://security.stackexchange.com/questions/206306/detecting-port-scanning-activity-of-a-mobile-app) and have Wireshark capturing packets from the iPhone but can't determine which applications are generating the traffic. Is this the best way and how do I determine the culprit application or is there a better way to find the rogue app?

I'm trying to debug a Safari specific issue, but I can't see the data being passed in the TLS stream from a packet capture because I need the ephemeral keys to decrypt the session. In Chrome or Firefox you can set the environment variable SSLKEYLOGFILE=/path/to/my-tls-session.keys and then use that file with wireshark to decrypt the session. So, is there a way in Safari to have it record the TLS session keys? If not, is there a way in Safari to capture the raw data stream that passes between it and the server?

While inspecting why rvictl -s command on a Macbook (Intel) running Big Sur, is failing to start/create a virtual interface for the connected iPhone, when issuing the command: sudo launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.rpmuxd.plist I get: /Library/Apple/System/Library/LaunchDaemons/com.apple.rpmuxd.plist: service already loaded Load failed: 37: Operation already in progress Does this mean the service is not fully loaded yet? If so, why does the service hangs loading?

When I look up google, I get an IPv6 address and not an IPv4 address This is giving me issues in Wireshark with the source since I can’t manage to map the different addresses for the same name. Can I force lookups to be IPv4 or do I have to handle more than one type of address to use wireshark?

As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces. However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets. How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored *without* administrative access?

I'm trying to route my iphone traffic through my mac to view it with wireshark. However rvictl is not on my machine. I have: * MacBook Pro (Retina, 13-inch, Early 2015) * El Capitan 10.11.6 * XCode 7.3.1 * XCode command line tools for XCode 7.3.1 (installed separately) However rvictl is no where on my machine. Any idea how to get it?

Does anyone know what the "access_bpf" group is / does. I noticed it when I went into Preferences > Users & Groups. I've searched around and found that it has something to do with Wireshark, however I have not installed the program on my Mac so I'm too sure how the group got added.

Issue: MacOS permissions falsely configured. Recently I had some networking issues on my mac running High Sierra, so I backed up my disk, completely wiped my mac, installed Mojave and then moved files over that I needed. However since upgrading, I'm getting tons of permission denied errors. For example, when installing some packages from Terminal, I'm forced to use sudo for almost every command as Mac isn't letting programs I install to even create folders... this happened again downloading Wireshark today, Mac wouldn't let Wireshark install properly and would throw back over 40 permission denied errors. I've attached an image from Wireshark, however I'm aware this doesn't count as a "log".

I'm currently attempting to debug a Super Duper startup problem where it takes between 10-15 seconds to start up on my machine when wireless/internet is turned on. I have communicated with Dave from Shirt Pocket who advised that Super Duper usually has a lag like this when there are network drives mounted on my machine (i.e. Super Duper would attempt to scan these resulting in the lag). When I turn wifi off, Super Duper starts up immediately. I don't have any network drives mounted on my machine and so this has all been very mysterious. Last night, I installed WireShark and tried to see if there's anything interesting going over the wire. I noticed that roughly around the time I start Super Duper up, I see the following in WireShark: Source | Destination | Protocol | Length | Info ---------------------------------------------------------------------------------- My IP | Router IP | DNS | 66 | Standard query 0xd574 A System Router IP | My IP | DNS | 66 | Standard query 0xd574 Server Failure The server failure is usually returns between 10-20 seconds (hence the correlation with the Super Duper start up lag). The request from my machine to the router sometimes happens repeatedly (i.e. 2 or 3 times) before the notice of failure returns from the router. I'm not very familiar with using WireShark and reading information off packets in this way (indeed, it's very odd that this is causing any issue with Super Duper at all given that it shouldn't be going out on the network to look for stuff as I don't have any network drives setup at all on my Mac) - my question here is: does anyone know what is happening here and why do I get a server failure from my router? Internet is working with no apparent issues. In case it becomes relevant: this is on a 2012 MacBook Air with OSX 10.9.4 plus the latest versions of Super Duper and WireShark.

I need to debug/view an IOS app's encrypted traffic, so i had captured SSL encrypted TCP packets via pirni. and trying to decrypt them via Wireshark. but i need session key for that. is there any way to export private key in IOS to be used with wireshark as in PKCS format?

I use Wireshark and it runs under X11 environment I want take some screenshot from wireshark windows but cmd + shift + 3 or cmd + shift + 4 or ... didn't work there is there any way that I could take some screen shot in X11 environment?

I installed wireshark using homebrew with the command brew install wireshark. Everything seems to install fine and I can use dumpcap to capture packets but now I want to view them. Using a text editor like vi doesn't format some of the output very well due to an abundance of unreadable characters. It looks like there should be a Wireshark.app to view the trace files with, however, I do not see how to start it. Any ideas?

I'm looking for deep/detailed research into how the MacOS TCP stack works. Namely, what are the files/Dynamic Libraries that offer this service? What Libraries does WireShark interact with? My goal is to trace a logical chain of drivers, processes, and configurations that enable a TCP connection to work. I'll inspect the version of the files, their corresponding default settings, and anything else that can influence their behavior. My goal is to diagnose the issue described in this question.

I am trying to use my Mac (I have a 2010 MacBook Pro) with *ettercap*, sniffing and MitM software, but I do not have a wlan0 card. All of the tutorials and recommendations I see for these "hacks" require wlan0. I have read that if you have an older card on your Mac it would be lo0, or local loopback, but that didn't make much sense to me considering all of the traffic I was getting from *Wireshark*. So could somebody please help me on how you are supposed to set this up? Would I need to buy a wireless card for sniffing?

I have a new MacBook Air. I would like to run Wireshark on it. But when I choose capture in Wireshark there is no interfaces to capture from. Doesn't Wireshark have support for the MacBook Air WiFi nic? How can I use Wireshark on a MacBook Air?

My Little Snitch Network Monitor tells me my machine is ping'ing 0.0.0.192 every second. What's going on? EDIT: A Wireshark capture tells me this ping has Source 0.0.76.188 Destination 0.0.0.192

I installed Wireshark Version 2.0.0 on OSX 10.11 with XQuartz 2.7.8 But it doesn't display any pane, I don't know what happened... Any suggestions?