For MacOS users, this is a heads up that if you are installing Wireshark, you will also need to install ChmodBPF in order for the application to get access to local interfaces. ChmodBPF comes from the libcap project and is a piece of software that sets up permissions for users to capture network packets. Fortunately, ChmodBPF is packaged with the installer; however, it is a separate step. Once you open Wireshark, there is a link to install it and the installer will run.
Here is more details: https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallOSXInstall.html
Subject: Installing Wireshark on Windows 8
Figured I'd post my experience in case anyone else has to install Wireshark on Windows 8. It turns out that the WinPcap bundled with Wireshark fails to install due to Windows 8 compatibility issues. To get around the problem what you can do is download WinPcap separately from www.winpcap.org and set the compatibility mode on the installation file to Windows 7 in the file properties. When you run the file it will still give you a compatibility warning but this time it will go through with the WinPcap install.
Subject: Installing WireShark under Ubuntu:
I ran into a problem, where WireShark wouldn't show any of my interfaces. I found a page that helped - http://ask.wireshark.org/questions/7523/ubuntu-machine-no-interfaces-listed. It looks like all I had to do was add my user to the "wireshark" group and reboot.
You can type "cat /etc/groups" Or just "groups" to see which groups your user belongs to.
Subject: Ipconfig on OS-X (Workarounds)
The DNS lab heavily depends on usage of ipconfig. If you're on a mac, ifconfig isn't easy to figure out. Here are some workarounds to get you through.
Launch your Terminal (/Applications/Utilities/Terminal.app) To get your default gateway, dns, and other info like ipconfig on Windows (try en1, or en2 if you have other network adapters): ipconfig getpacket en0 To flush your dns cache run both of these: sudo killall -HUP mDNSResponder sudo dscacheutil -flushcache To view entries in your cache do: sudo killall -INFO mDNSResponder open /var/log/system.logOnce the system log is open, you can scroll up and see your cache entries.
Source: Apple KB Article
** I also had some issues with WinPCap (something required to allow WireShark from running). I had to run the command prompt in administration mode in order to resolve the issue - I used Google to help me.
If you're having trouble installing wireshark in Mac, it is most likely because X11 was removed from OS X recently. To fix, install XQuartz, then you should be able to run Wireshark. http://xquartz.macosforge.org/landing/ Source: Apple KB Article Subject: Running Windows 7 VM on Mac and issues with PingPlotter Hopefully this will help someone out because I was stumped until my networking genius fiance stepped in and helped me out. I'm running Wireshark in Windows 7 which I'm running via Parallels on my Mac because I could not get Wireshark to work on the Mac side. I went to install and run PingPlotter per the lab instructions and I was only getting 1 hop and not a listing of the 15 or so that I should get. Turns out you have to make sure your VM is using a "Bridged Connection" for network connectivity and not "Shared Connection".
So, installing wireshark on OSX post-x11-removal is kind of annoying. The following worked though: Install Wireshark, using the installer from http://wireshark.org. Install XQuartz, using installer from Xquartz Open /Applications/Wireshark.app, which shows the Wireshark icon in the dock and a picker dialog, titled Where is X11?, listing the apps from /Applications. From the picker dialog, click Browse button, and choose /Applications/Utilities/XQuartz.app. This appears to do nothing other than show the XQuartz icon in the dock and open xterm. Right-click the Wireshark icon, and choose Quit. Do the same for the XQuartz bicon. Then you can open wireshark from spotlight/desktop as you would with other apps. Source: https://ask.wireshark.org/questions/12140/cant-run-wireshark-in-mac-os-x-mountain-lion