How to sniff packets on Mac OS 10.7 Lion? [closed]

Question

I'm developing a website that uses SSL (connction to https) and I want to confirm that all the data sent is encrypted. Could anyone give me a good free packet sniffer on Mac OS that I could use?

Thanks!

Carola

Answer 1

It's not as slick as Wireshark, but OS X has a built-in command line tool for capturing and displaying packets:

sudo tcpdump -A -s0 -ien0 port 80

(the -A flag makes it display the packets' contents as text, -s0 makes it capture entire packets not just the headers, -ien0 makes it capture on the first ethernet interface (generally, the wireless is en1), and port 80 makes it only capture traffic to/from port 80 (see the man page for more options for capture patterns.)

Sidney

Answer 2

Don't forget Packet Peeper, WireShark is not so nice on Mac.

http://packetpeeper.org/

Eta

Can you elaborate why wireshark is not so nice on Mac? – Shane

@DanEsparza GTK+ (with default theme) on OS X obviously looks uglier than native interface. – Bertine

@Bertine Agreed. It's such a mess that after I installed (and winced) I uninstalled. – Shane

Packet Peeper appears to be abandoned (no updates since 2009), but still works fine for me. Far better UI than Wirewhark, and does TCP stream reassembly (the main feature I miss in tcpdump). – Sidney

Packet Peeper doesn't work with virtual devices created with rvictl (Remote Virtual Interface Tool).. – Clippers

There has been updates made in 2014 - so its still alive and kicking it seems :) – Torrie

Answer 3

Wireshark, or, Lion comes with one built in. Find it at /System/Library/CoreServices/Wi-Fi Diagnostics. I prefer Wireshark.

Paraph

Given that Wi-Fi Diagnostics just writes out a pcap file, and does nothing to help you read it, Wireshark, or even tcpdump, is preferable for Mr. Smith's purposes. (I also don't know whether it'll capture on non-Wi-Fi interfaces, if that's what he wants.) – Trebizond