What causes the Wireshark permission error on macOS?

The error occurs when Wireshark lacks the necessary permissions to access the Berkeley Packet Filter (BPF) devices on macOS. You may see the message: 'The capture session could not be initiated on the device en0 (You don't have permission to capture on that device).'

What is ChmodBPF and how does it fix the Wireshark permission error?

ChmodBPF is a utility that adjusts the permissions on BPF devices on macOS, allowing Wireshark to capture network traffic without requiring root-level access. Installing it grants the necessary permissions to perform packet captures.

Does installing ChmodBPF alone fix the Wireshark permission error on macOS?

Not always. While installing ChmodBPF is a common first step, additional configuration steps may be required to fully resolve the permission error in Wireshark on macOS.

Which network interface is typically affected by the Wireshark permission error on macOS?

The error commonly affects the en0 interface, which is typically the primary Wi-Fi or Ethernet interface on macOS devices.

How do I start a packet capture in Wireshark after fixing the permission error on macOS?

After resolving the BPF permission issue by installing and configuring ChmodBPF, you should be able to select your network interface (such as en0) in Wireshark and start a pcap session without encountering the permission error.

14 Jan 2023 Macbooks Networking Open Source

Fix Wireshark Permission Error on macOS: ChmodBPF Guide

By Andrew Baker · Group CIO, Capitec Bank · 14 January 2023

Sponsored

Never Lose Your WordPress Site

Free forever · One-click restore · S3, Google Drive & Dropbox

Get It Free →

👁417views

ChmodBPF fixes Wireshark's permission error on macOS by granting your user account access to Berkeley Packet Filter devices. Install it via the Wireshark macOS package or Homebrew, then add your user to the `access_bpf` group and restart your Mac. If the error persists, manually run `sudo chmod 644 /dev/bpf*` to restore device permissions.

Fix Wireshark Permission Error on macOS: ChmodBPF GuideAndrew Baker's Technology Blog Posts, 14/Jan/2023
https://andrewbaker.ninja/2023/01/14/fix-wireshark-permission-error-on-macos-chmodbpf-guide/

Article Summary

1.
What it is
Describes how to fix a Wireshark permission error that prevents packet capture on macOS devices, specifically when users can't initiate capture sessions due to insufficient device permissions.
2.
Why it matters
This error blocks network troubleshooting and analysis work, preventing users from capturing network traffic needed for debugging connectivity issues or analyzing network performance.
3.
Key takeaway
The standard ChmodBPF installation may not solve this permission error, requiring additional manual configuration steps.

49 words · ~1 min read

If you see the error “The capture session could not be initiated on the device “en0” (You don’t have permission to capture on that device)” when trying to start a pcap on wireshare you can try installing ChmodBPF; but I suspect you will need to follow the steps below:

$ whoami
superman
$ cd /dev
/dev $ sudo chown superman:admin bp*
Password:
$ ls -la | grep bp
crw-------   1 cp363412  admin     0x17000000 Jan 13 21:48 bpf0
crw-------   1 cp363412  admin     0x17000001 Jan 14 09:56 bpf1
crw-------   1 cp363412  admin     0x17000002 Jan 13 20:57 bpf2
crw-------   1 cp363412  admin     0x17000003 Jan 13 20:57 bpf3
crw-------   1 cp363412  admin     0x17000004 Jan 13 20:57 bpf4
/dev $

4 comments

andreas says:

18/Feb/2023 at 23:57

Fantastic, worked for me on the first try. Thank you very much.

Reply
Dave Blackbourn says:

19/Mar/2023 at 06:15

I do not use WireShark regularly but whe I do I NEED it!
Thank you Andrew for your fix of my ‘The capture session could not be initiated on capture device “en0” (You don’t have permission to capture on that device)’
Regards, Dave

Reply
Tony B. says:

13/Nov/2023 at 19:51

This really should be top of the list in Google results!
Fixed my issue in a jiffy.
Thanks.

Reply
Joost says:

26/Mar/2024 at 11:21

It didn’t work for me. (MacOS 14.1.2)

I did the following to fix it:
– uninstall the package ChmodBPF by running Uninstall ChmodBPF.pkg
– Goto users and groups under settings (on your Mac, choose Apple menu > System Settings, then click Users & Groups in the sidebar. (You may need to scroll down.) Click the Add Group button. (You may need to scroll down.) and create a group: “access_bpf”, click on the information “i” and flip the switch next to your username.
– Install ChmodBPF by running ChmodBPF.pkg

Reply

Fix Wireshark Permission Error on macOS: ChmodBPF Guide

4 comments

Leave a comment Cancel reply