NPF (part of WinPCAP) must be installed and configured to start automatically at boot. Only an Administrator can install/configure this, but once it is installed and properly configured, any user on the system should be able to capture traffic.
For the original question regarding capture on a Mac:
* By default only root can capture on a Mac. Even if your user account is set up with admin privileges, it won't work unless you change the permissions.
* If you change the permissions on /dev/bpf* as suggested below, the change only lasts until reboot with newer versions of OS X.
* If you want to make the change persistent between reboots, install the ChmodBPF Startup Item that comes on the Wireshark DMG. (It's in the Utilities folder.) By default this will only allow Administrator users to capture, but you can edit the script before you install it (see the instructions) to allow anyone to capture.
On Apr 4, 2010, at 1:19 AM, vincent paul wrote:
> HI,
> How to start wireshark to show Interface card without admin right on Windows XP.
>
> thanks,
>
> PV
>
> --- On Sat, 4/3/10, Michael Tüxen <Michael.Tuexen@xxxxxxxxxxxxxxxxx> wrote:
>
> From: Michael Tüxen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>
> Subject: Re: [Wireshark-users] New MAC user, No Capture Interfaces
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Date: Saturday, April 3, 2010, 11:37 AM
>
> Hi,
>
> to allow everyone on the machine to capture packets, execute the following command
> sudo chmod uog+r /dev/bpf*
> in a shell.
>
> Best regards
> Michael
> On Apr 2, 2010, at 9:19 PM, Robert Davis wrote:
>
> > I’m a new macbook pro user. When I installed Wireshark on my MAC I don’t get any interfaces to choose for capture.
> > How do I get the interfaces (wired and wireless) to show up?
> >
> > <image.png>
> >
> > <image.png>
> > ___________________________________________________________________________
> > Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> > Archives: http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> > mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
> <ATT00001..txt>
--
Phillip Paradis / Network Engineer / United Tote
Phone +1 502 509 7445 / Email phillip.paradis@xxxxxxxxxxxxxx