Install Wireshark on MacOS X via brew

Question

I installed Wireshark on my mac with the command

brew install wireshark

but after that, a message told me that I had to curl and install ChmodBPF, so I did that too.

But there is no command named Wireshark on terminal. What is wrong with that?

Try `hash -r` to have your shell rehash the newly available commands. Also, check in `/usr/local/bin` for new stuff, like this `ls -lrt /usr/local/bin` - new stuff at bottom of list. Also, make sure `/usr/local/bin` is in your PATH. — Mark Setchell, Oct 07 '14 at 18:00
I found that there is no wireshark in /usr/local/bin but there is tshark and rawshark! I am beginner in wireshark, are tshark and wireshark same? — Aryan, Oct 07 '14 at 18:06

score 156 · Accepted Answer · edited May 08 '17 at 18:42

156

The homebrew package wireshark installs the command line util tshark. If you want to enable the GUI, then install wireshark like this:

brew install wireshark --with-qt

If you already have Wireshark installed, do

brew reinstall wireshark --with-qt

edited May 08 '17 at 18:42

Thanatos

42,585
14
91
146

answered Dec 29 '14 at 21:02

Allan Beaufour

1,768
1
11
5

2

It works! How did you figure this out? By guessing from `brew cat wireshark`? How did you know to use `with-qt` over `with-gtk+3`? – Jerry101 Dec 12 '15 at 00:45
I needed --with-qt5 to prevent a weird sizing issue. – ThatOneDude Aug 12 '16 at 01:52
14

This has been deprecated. Please update answer to: `brew reinstall wireshark --with-qt5` – N0thing Aug 12 '16 at 16:47
2

@chovy Open a terminal and run `wireshark` to start the GUI. – phoenix Nov 01 '16 at 13:27
10

Note that the flag `--with-qt5` is now listed as deprecated. One should use `--with-qt`. – Mike May 05 '17 at 19:06
11

This is not the recommended approach for a GUI application like Wireshark, please see [Radu's answer](https://stackoverflow.com/a/43342934/427545) below. At the moment it will also miss features like external name resolution (DNS), codec support and more. Use `brew cask install wireshark` instead. – Lekensteyn Aug 28 '17 at 10:28
2

> **Error: invalid option: --with-qt** – IgorGanapolsky Sep 07 '20 at 15:11
2

brew install --cask wireshark – lAH2iV May 10 '21 at 16:58

score 117 · Answer 2 · edited Jan 25 '21 at 11:27

117

I suggest using cask to create the .app binary in your /Applications folder (use reinstall if already installed):

brew install --cask wireshark

The advantage of this approach over brew install wireshark --with-qt is that more features are enabled without spending a lot of time compiling.

This is also the recommended approach for graphical applications and will use the official, feature-complete builds as distributed by the Wireshark developers.

edited Jan 25 '21 at 11:27

Seonghyeon Cho

171
1
3
11

answered Apr 11 '17 at 10:09

Radu

2,027
1
15
10

4

For me, I had to use `brew install --cask wireshark`. If you use this, you may need to uninstall the non-cask version of wireshark prior to installing the cask. – alex Dec 29 '20 at 14:54
2

This is the correct way to do it in 2022. – skupjoe Feb 10 '22 at 02:27

Kris Stern · Answer 3 · 2021-04-02T16:49:00.850

24

I don't think the command brew install wireshark --with-qt works anymore as of July 2019 on my laptop running macOS Mojave. So my approach to install Wireshark using Homebrew is to follow the below steps:

Update Homebrew: `brew update'
Tap the Caskroom/Cask GitHub repository using HTTPS: brew tap caskroom/cask
Search all known casks for wireshark: brew search wireshark
Find out info about the wireshark cask (to be sure): brew info --cask wireshark
Install the wireshark cask: brew install --cask wireshark
Clean up (just in case): brew cleanup

If all goes well, one should see wireshark was successfully installed! after Step 5.

edited Apr 02 '21 at 16:49

answered Jul 16 '19 at 14:33

Kris Stern

1,192
1
15
23

2

Type `wireshark` in terminal after all these steps to launch the GUI interface. – Mike Aug 18 '19 at 22:53
2

Actually it is now `brew install --cask wireshark` – Rui F Ribeiro Mar 06 '21 at 18:50
1

Error: caskroom/cask was moved. Tap homebrew/cask instead. – Talobin Mar 09 '21 at 21:45
2

I tried cask but now when running wireshark from terminal I get `zsh: command not found: wireshark` – reactor Mar 28 '21 at 18:05

score 7 · Answer 4 · answered Oct 07 '14 at 18:17

7

I found that I asked wrong question! Wireshark is gui that use tshark or ... at the back and when I install with brew, it install tshark and ... So that is reasonable that I could not found wireshark in terminal but I could find tshark!

answered Oct 07 '14 at 18:17

Aryan

2,675
5
24
33

1

ln -s /usr/local/bin/tshark /usr/local/bin/wireshark – CousinCocaine Oct 17 '14 at 14:32
1

Yes, use the --with-qt flag with brew to get the GUI also. – neontapir Dec 11 '14 at 04:43
i did that. how do i start the gui? – chovy Nov 07 '15 at 19:52
Just run wireshark in terminal! – Aryan Nov 08 '15 at 10:04
1

I just ran `brew reinstall wireshark --with-qt5` and the final instruction is the one you want: .app bundles were installed. Run `brew linkapps wireshark` to symlink these to /Applications. ==> Summary /usr/local/Cellar/wireshark/2.2.1: 679 files, 145.7M, built in 4 ominutes 33 seconds Buddha:~ Jim$ brew linkapps wireshark Linking: /usr/local/opt/wireshark/Wireshark.app Linked 1 app to /Applications Buddha:~ Jim$ – Jim Monty Nov 04 '16 at 17:43
2

(To hell with mini-Markdown! I'm one half hour closer to my death now and I could have use that half hour much more productively than to try repeatedly to format my comment above as it should be formatted and to fail repeatedly.) – Jim Monty Nov 04 '16 at 17:52

learn webtech · Answer 5 · 2021-01-11T00:39:19.113

2

The command works perfectly

 brew install --cask wireshark

and install the interface via

brew install --cask wireshark-chmodbpf

link to the homebrew page

https://formulae.brew.sh/formula/wireshark

edited Jan 11 '21 at 00:39

answered Jan 11 '21 at 00:31

learn webtech

21
3

Install Wireshark on MacOS X via brew

5 Answers5