How to Install Wireshark in MacOS

Wireshark is one of the best tools for capturing and analyzing network packets. On macOS, you can install it easily using Homebrew or by downloading the official installer. Here’s how to do it cleanly and safely.

Step 1: Check if Homebrew Is Installed

Homebrew makes it easy to install and manage software on macOS. To check if it’s already installed, run:

brew -v

If you see a version number, you’re good.
If not, install it with:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Once done, update it:

brew update

Step 2: Install Wireshark via Homebrew

The easiest way to get Wireshark is through Homebrew Cask:

brew install --cask wireshark

This installs both the graphical Wireshark app and the command-line tools.

Step 3: Allow Packet Capture for Non-Root Users

By default, macOS requires elevated privileges to capture packets.
After installation, Homebrew will ask:

Do you want to allow non-superusers to capture packets?

If you missed it, you can manually enable capture permissions:

sudo chgrp admin /dev/bpf*
sudo chmod g+rw /dev/bpf*

These commands grant your admin group access to the packet capture devices.

Step 4: Launch Wireshark

You can start Wireshark from:

• Applications → Wireshark, or

• The terminal:

  open /Applications/Wireshark.app

Once it opens, choose your network interface (e.g., Wi-Fi, Ethernet) and start capturing packets.

Step 5: Verify Installation

To confirm the installation:

wireshark --version

You should see output similar to:

Wireshark 4.4.0 (v4.4.0 packaged as an app bundle)

Optional Step: Install Command-Line Tool (tshark)

If you want to capture and analyze packets directly from the terminal:

brew install wireshark-cli

Then run:

sudo tshark -i en0

Replace en0 with your network interface name.