3 ms·
$ tcpdump -i lo0 -s 65535 -w info.pcap tcpdump: lo0: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permi
by msbarnett 11y ago
$ tcpdump -i lo0 -s 65535 -w info.pcap
tcpdump: lo0: You don't have permission to capture on that device
((cannot open BPF device) /dev/bpf0: Permission denied)
Looks like you're logged in on a superuser account or have otherwise somehow disable some security settings.
- yborg 11y agoI also can't access loopback on 10.11.3, I get this exact error. And I'm running as an Administrator account.
- msbarnett 11y agoYeah, it's that they installed Wireshark, and gave it privileges to chown the loopback interfaces. edit: Irony here is that Wireshark is doing something far more dangerous than 1password.
- jlgaddis 11y agoIt's either a) change the group on the /dev/bpf entries and add your user to that group or b) run Wireshark as root.
- msbarnett 11y agob) would in general be a lot safer, in that you're elevating one process rather than lowering a privileged interface so that every process you run can sniff it.
- julie78787 11y agoCorrect - Least Privilege says you do the absolute least you need to do in order to make things work, so that any errors are limited to that one part of the system. What's been done here by Wireshark isn't least privilege, or secure. Its like the opposite of least privilege and security.
- lttlrck 11y agoOn Linux you can give an executable admin access to network devices with setcap which narrows it down further. Is the same possible on OS X? Edit. Actually this is worse than running as root isn't it!
- cyphar 11y agosetcap is in principle better than setuid if your program is something like ping. Or in this case, wireshark.