How to capture USB traffic with Wireshark in OSX Catalina (10.15)

Question

I am trying to get Wireshark USB captures working. Apparently the trick prior to Catalina was to just bring the interface up so that Wireshark could see it.

https://forums.developer.apple.com/thread/95380

However, this does not work in Catalina because the USB hubs are not shown as interfaces any longer. Is there another known way to "bring up" these interfaces in OSX? Perhaps a new system policy setting? How would one go about finding such a thing?

It might just be broken now. I imagine Wireshark and ifconfig use the same API to gather info about the interfaces.

Flurried

This is a good question but does not have a programming component, which is the focus of Stack Overflow. You should post it to the Wireshark forums, where Wireshark developers and power users live. – Hospodar

Answer 1

You need to disable SIP first

1. Restart your Mac
2. Hold down Command-R to reboot into Recovery Mode
3. Click Utility->Terminal, type "csrutil disable", click Enter.
4. Restart your Mac

then you can use "sudo ifconfig XHC20 up" command

Cnut

Maybe this works. I cannot confirm as I just downgraded to Mojave to sidestep the issue. But oof. Imagine having to completely disable a system-critical protection feature just to allow a really useful feature to work. – Flurried

Very helpful, thanks! Differences on a Mac Mini (M1 chip): - Recovery is: Power off. Power on, holding power button until startup options come up. - Available interfaces are XHC0 and XHC1, and possibly others with a USB hub. – Caseous