wireshark for mac

权限管理是个让人既爱又恨的东西...

Windows Vista因为加了个UAC就让无数小白骂得狗血淋头,相对而言OS X处理得好得多.但在跑一些从Unix/Linux移植过来的程序的时候,还是要纠结一下...

比如Wireshark...

下面讲讲我是怎样纠结地把它折腾好的...Step by step:

1)首先肯定是下载...就不多说了,按照系统版本...我的是Mac OS X 10.6 Snow Leopard,但我码这篇字的时候还没有相应版本,于是下的for 10.5 Leopard的

2)下完展开dmg文件,看到:

 

安装进行到这里还比较正常,按照一个mac用户的习惯,把Wireshark的图标拖到Applications里面先~

3)然后打开Utilities文件夹:

 

把ChmodBPF拖到StartupItems里(需要验证权限...第1次),然后打开终端(如果连终端是什么都不晓得就control+空格打开spotlight搜- -b)

输入(或者把下面的命令复制粘贴到终端里执行):

sudo chown -R root:wheel ChmodBPF

需要验证权限...第2次...这句话的意思是把ChmodBPF的拥有者改成root

4)继续在终端输入:

sudo cp /Volumes/Wireshark/Utilities/Command/ Line/* $home/bin

还是需要验证权限...第3次...

这句话意思是把上面Command Line文件夹里的所有文件复制到你自己主文件夹的bin文件夹里,这样以后就可以通过命令行使用Wireshark了

5)还是在终端输入:

sudo vi /Library/StartupItems/ChmodBPF/ChmodBPF

然后在文件里加入一行:

StartService ()

{

    #

    # Unfortunately, Mac OS X's devfs is based on the old FreeBSD

    # one, not the current one, so there's no way to configure it

    # to create BPF devices with particular owners or groups.

    # This startup item will make it owned by the admin group,

    # with permissions rw-rw----, so that anybody in the admin

    # group can use programs that capture or send raw packets.

    #

    # Change this as appropriate for your site, e.g. to make

    # it owned by a particular user without changing the permissions,

    # so only that user and the super-user can capture or send raw

    # packets, or give it the permissions rw-r-----, so that

    # only the super-user can send raw packets but anybody in the

    # admin group can capture packets.

    #

    chgrp admin /dev/bpf*

    chmod g+rw /dev/bpf*

    chown can:admin /dev/bpf*

}

StopService ()

{

    return 0;

}

RestartService () { StartService; }

RunService "$1"

注意把"can"改成你自己的用户名,不知道就用"whoami"命令查看一下

当然不习惯vi的也可以用别的编辑器

6)然后终于可以打开Wireshark了...

...但是此时你会看到很多错误= =...

解决方案是,打开Edit->Preferences->Name Resolution->SMI Paths:

 

加入一条"/usr/share/snmp/mibs",然后一路确定下去...

这个貌似是Wireshark在OS X下的一个bug

7)关掉Wireshark,然后在终端运行:

sudo chgrp admin /dev/bpf*

sudo chmod g+rw /dev/bpf*

sudo chown can:admin /dev/bpf*

呃...貌似又要验证权限...

然后再打开Wireshark就OK了~如果没OK,重启机器试试- -b...