How to sniff packets on Mac OS 10.7 Lion?

Question

I'm developing a website that uses SSL (connction to https) and I want to confirm that all the data sent is encrypted. Could anyone give me a good free packet sniffer on Mac OS that I could use?

Thanks!

score 69 · Accepted Answer · answered Feb 17 '12 at 04:25

It's not as slick as Wireshark, but OS X has a built-in command line tool for capturing and displaying packets:

sudo tcpdump -A -s0 -ien0 port 80

(the -A flag makes it display the packets' contents as text, -s0 makes it capture entire packets not just the headers, -ien0 makes it capture on the first ethernet interface (generally, the wireless is en1), and port 80 makes it only capture traffic to/from port 80 (see the man page for more options for capture patterns.)

score 11 · Answer 2 · edited May 20 '14 at 12:37

11

Don't forget Packet Peeper, WireShark is not so nice on Mac.

http://packetpeeper.org/

edited May 20 '14 at 12:37

Community

1
1

answered Sep 25 '12 at 18:29

AbiusX

2,379
20
26

1

Can you elaborate why wireshark is not so nice on Mac? – Dan Esparza Nov 25 '12 at 16:59
2

@DanEsparza GTK+ (with default theme) on OS X obviously looks uglier than native interface. – ivanzoid Dec 05 '12 at 16:27
1

@ivanzoid Agreed. It's such a mess that after I installed (and winced) I uninstalled. – Dan Esparza Dec 05 '12 at 21:34
Packet Peeper appears to be abandoned (no updates since 2009), but still works fine for me. Far better UI than Wirewhark, and does TCP stream reassembly (the main feature I miss in tcpdump). – Gordon Davisson Apr 11 '13 at 20:42
Packet Peeper doesn't work with virtual devices created with `rvictl` (Remote Virtual Interface Tool).. – Koen. May 24 '14 at 11:44
There has been updates made in 2014 - so its still alive and kicking it seems :) – slott Jan 24 '15 at 16:33

score 3 · Answer 3 · answered Feb 17 '12 at 01:57

3

Wireshark, or, Lion comes with one built in. Find it at /System/Library/CoreServices/Wi-Fi Diagnostics. I prefer Wireshark.

answered Feb 17 '12 at 01:57

Marty

5,926
9
53
91

Given that Wi-Fi Diagnostics just writes out a pcap file, and does nothing to help you read it, Wireshark, or even tcpdump, is preferable for Mr. Smith's purposes. (I also don't know whether it'll capture on non-Wi-Fi interfaces, if that's what he wants.) – Sep 28 '12 at 01:35

How to sniff packets on Mac OS 10.7 Lion?

3 Answers3