You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark. If you open System Preferences and then Users & Groups, you'll be able to fold out the 'Groups' part of the tree and see 'access_bpf' listed there. The access_bpf groups is actually also created by Wireshark installer. If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files. you have to enter an administrator user password to install the software). More specifically you can look at the file /Library/LaunchDaemon/ to see what it does and when it is run.Īs creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. It is meant to support Wireshark where unprivileged access to macOS packet capture devices is desired.

An accessbpf group will be created and its members allowed access to BPF devices at boot to allow unprivileged packet captures. Rename the Startup folder to 'ChmodBPF' instead of 'Startup'. Enable Wireshark to acces macOS capture devices. Open the Startup folder you just copied, and delete 'README.macosx'. Drag the 'Startup' folder to the Desktop. On the disk image, open the Utilities folder. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. Drag the Wireshark app to your Applications folder. The reason is that the Wireshark installer installs a LaunchDaemon (i.e.

Wireshark mac install