Macbook: Fixing the Wireshark Permissions bug “You don’t have permission to capture on that device”

If you see the error “The capture session could not be initiated on the device “en0″ (You don’t have permission to capture on that device)” when trying to start a pcap on wireshare you can try installing ChmodBPF; but I suspect you will need to follow the steps below:

$ whoami
superman
$ cd /dev
/dev $ sudo chown superman:admin bp*
Password:
$ ls -la | grep bp
crw-------   1 cp363412  admin     0x17000000 Jan 13 21:48 bpf0
crw-------   1 cp363412  admin     0x17000001 Jan 14 09:56 bpf1
crw-------   1 cp363412  admin     0x17000002 Jan 13 20:57 bpf2
crw-------   1 cp363412  admin     0x17000003 Jan 13 20:57 bpf3
crw-------   1 cp363412  admin     0x17000004 Jan 13 20:57 bpf4
/dev $

4 thoughts on “Macbook: Fixing the Wireshark Permissions bug “You don’t have permission to capture on that device””

  1. I do not use WireShark regularly but whe I do I NEED it!
    Thank you Andrew for your fix of my ‘The capture session could not be initiated on capture device “en0” (You don’t have permission to capture on that device)’
    Regards, Dave

  2. This really should be top of the list in Google results!
    Fixed my issue in a jiffy.
    Thanks.

  3. It didn’t work for me. (MacOS 14.1.2)

    I did the following to fix it:
    – uninstall the package ChmodBPF by running Uninstall ChmodBPF.pkg
    – Goto users and groups under settings (on your Mac, choose Apple menu > System Settings, then click Users & Groups in the sidebar. (You may need to scroll down.) Click the Add Group button. (You may need to scroll down.) and create a group: “access_bpf”, click on the information “i” and flip the switch next to your username.
    – Install ChmodBPF by running ChmodBPF.pkg

Leave a Reply

Your email address will not be published. Required fields are marked *