Ethereal on Mac OS X

With perfect password manager, I thought I had the complete set of tools in my Mac for getting things done. But today I realized, I’d overlooked ethereal. I use it sometimes and it’s a gem without which it would be very difficult to solve some network problems. Ethereal is a free and open source packet sniffer application, used for network troubleshooting, analysis, software and protocol development, and education. It has all of the standard features of a protocol analyzer.

I was happy to see Ethereal for Mac OS X listed at the top of the download page. But, was confused with the choice I had to make between Fink Project and DarwinPorts. I was not sure what they meant or which one was better. So, after Googling a while and reading the FAQs, I found that the number one goal of both projects were to port open source Linux/Unix softwares to Mac OS X. They just differ in the packaging approach they’ve taken. DarwinPorts was written from scratch to try a different approach to a packaging system, where as Fink Project utilizes robust package management tools dpkg and apt-get from Debian Linux Project . So, I decided to try ethereal with Fink Project and this is how I did it.

Apple’s X11 and XCode environment
Ethereal is a GUI application that requires some flavor of X11 on your Mac and Fink will need the developer tools to compile some packages from source. I’m using Mac OS X 10.4.7 and installed the X11 and XCode from the Tiger installation disc. It’s straight forward; you just need to run the installer and follow instructions.

Fink Project
Download the Fink installer disk image, there’s also a quick start guide in the download page to help you install the fink. Basically what you’ve to do is double-click "Fink-0.8.1-XYZ-Installer.dmg" to mount the disk image, then double-click the "Fink 0.8.1 XYZ Installer.pkg" package inside, and follow the instructions on screen. At the end, a pathsetup utility will ask for permission before your shell’s configuration files are edited. You should answer "Yes".

Install the FinkCommander GUI application included in the Fink package. This is done by dragging and dropping the to Applications folder. Then run the and choose the following commands from its menu: Source->scanpackages followed by Source->Utilities->index. If you are comfortable with command lines, you can achieve the same thing by opening a new Terminal window and running: "fink scanpackages; fink index"

After scanning and indexing of packages are completed, you can install any of the available packages from the list. To install ethereal — highlight the ethereal from the list, and choose Binary->Install. Or you can use the following command line to install: "fink install ethereal"

Download and install AquaEthereal, which provides a convenient way to launch ethereal in Mac OSX. After the installation, you can start the from your Applications folder. This launches the X11 environment first, then prompts you for your password. Input your password, press ok and you’re ready to capture packets with ethereal.

Be Sociable, Share!
Posted in Admin, Apple, HowTo, Linux/Unix, Network, Security, Technology
16 comments on “Ethereal on Mac OS X
  1. Nic says:

    I followed the directions and now AquaEthereal starts to launcha nd then quits. Now sure what I did wrong.

  2. AquaEthereal is just a launcher, actually ehtereal can run without it. You can try to run the Ethereal directly from the finder by double clicking “ethereal” (Your HDD –> sw –> bin –> ethereal). When you launch the ethereal directly by double clicking it, you need to modify the permission of your device from the terminal as following: “chown yourname /dev/bpf*”

  3. Nic says:

    thank you for the tip. I can’t find capture interface.

  4. Nic says:

    I got it work when I log in as root. Thank you for your help.

  5. Philp Stoddard says:

    thanks a million. you saved me years.

  6. Gerald Combs says:

    Due to trademark issues, Ethereal was re-branded “Wireshark” ( last May. An OS X package is available as well.

  7. Thanks for the update Gerald. Good to know that OS X packages are available as well. I just checked the sources; Fink still don’t have binary, I’m confused with the DarwinPorts and only Andreas Fink seems to have a Wireshark package but with around 20 dependencies :(. They’re promising a combined single installer soon, which should be attractive to Mac users.

  8. *.Har(d)t says:

    Thank you very much. Great tutorial, very accurate.
    Plus, I discovered the Fink Project, and that is HUGE !

  9. PhoneixS says:

    Fantastic, I folow it and I get the ethereal runing.

  10. efran says:

    I have the problem where AquaEthereal quit after I input a password.
    I’m using default login (apple). How can I log in as a root?

  11. Hi efran, here’s how you can enable the root user in Mac OS X.

    You can also check one of my earlier comment which you might find useful.

  12. Jon says:

    Before I go the route with Fink, has anyone tried running this installer on a OS X box that has Gimp installed? I use Gimp a lot and would not like to see that X11 config stomped by the Fink install.

  13. Masum says:

    I have Mac OS 10.5.4. So, I have downloaded Fink-0.9.0-Intel-Installer.dmg and followed the steps you directed upto FinkCommander. But I could not find ethereal package here. So, I installed wireshark package instead and SharkLauncher(actually just decompress) from your provided link for AquaEthereal. When I launch SharkLauncher, it prompts for password as expected, but after about a minute it justs close down even before showing any GUI. I tried log in as root even with no success. Could you please help me?

  14. a really good post by you looking forward to visit more very soon.

  15. Seasons says:

    Best you could make changes to the blog name » Ethereal on Mac OS X to more specific for your webpage you write. I enjoyed the post all the same.

  16. Man says:

    I can’t find fink with sources and ethereal web page

2 Pings/Trackbacks for "Ethereal on Mac OS X"
  1. […] EtherealEthereal is a free and open source packet sniffer application, used for network troubleshooting, analysis, software and protocol development, and education. It has all of the standard features of a protocol analyzer. This is a gem without which it would be very difficult to solve some network problems. For installation check Ethereal on Mac OS X. […]

  2. […] Ethereal works right out of the Fink package manager.  I love working over the filters in Ethereal/Wireshark, but with Ethereal I don’t get the “live” packet captures.  It’s a capture then analyze hand-off, which I’m probably going to have to go another way with sometime soon.   But damn, I’m just glad to have something to help me out. […]

Leave a Reply

Your email address will not be published. Required fields are marked *


Recent Comments

Muhammad Ali on Meeting Buddha Boy: I am really moved by seeing a…(January 16, 2018, 4:43 pm)
LastMarina on How I Prepared and Passed CISSP : I see you don’t monetize your site,…(January 11, 2018, 5:20 pm)
FirstCandace on WinXP and OSX dual boot in MacBook Pro: I have noticed you don’t monetize your…(November 10, 2017, 11:32 pm)
From Wikipedia, the free encyclopedia – Ram Bahadur Bomjon on Buddha Boy attacked and injured a guy with his sword?: […] Niranjan (July 20, 2007). “Buddha Boy…(September 2, 2017, 5:07 pm)
Micle on How I Prepared and Passed CISSP : Nice Aritcle…(August 10, 2017, 8:51 am)