Wireshark-users: [Wireshark-users] Mac OSX new MacBook Pro

From: Mike Savory <msavory-shark@xxxxxxxxx>
Date: Sat, 28 Oct 2006 17:35:22 -0700
I just received my new MBP today, and the first thing I did was install Wireshark (via Macports, which works perfectly for me on my current Powerbook G4)

http://www.macports.org/
Specifically...
http://svn.macports.org/repository/macports/trunk/dports/net/ wireshark/Portfile

The interesting issue is that as soon as I do a "> sudo tshark -i en1" it kills my wireless association, and I have to reconnect after the capture to get back into my Apple Extreme wireless connection, all other devices on the network are unaffected.

If I run Wireshark under X it has the same effect.

Running " > sudo tcpdump -i en1  works fine as you would expect.

When running Wireshark the wireless network dies as soon as you open a "List the available Capture Interface" window the wireless connection dies. The window shows the interface "wlt1", "ifconfig" shows the en1 as inactive. Performing an actual capture on this interface shows the 802.11 beacon frames from my AP.

This is annoying as I often use Wireshark to capture on my en0 while remaining connected to my network via en1, but as soon as I open a capture dialog, my network connection drops.

Has anyone else seen this on Intel Macs? Or is it perhaps a function of the drivers for the "Pre-802.11n" Athereos chipset used in the newest Macs??


Regards

Mike