Wireshark Download Team
Updated March 2026
macOS Guide
Download Wireshark for macOS with native Apple Silicon support. Includes ChmodBPF setup, Homebrew install, and fixes for common Mac-specific issues.
File size: ~141 MB • Requires macOS 12 Monterey or later • Free & Open Source
| Version | 4.6.4 (Stable) — February 27, 2026 |
| File Name | Wireshark 4.6.4 Universal.dmg |
| File Size | ~141 MB (Universal Binary) |
| Architectures | Intel (x86_64) + Apple Silicon (arm64) in one package |
| macOS Minimum | macOS 12 Monterey (4.6.x) • macOS 11 Big Sur (4.4.x) |
| License | Free & Open Source (GPLv2+) |
| Includes | ChmodBPF (packet capture permissions) + PATH helper |
| Homebrew | brew install --cask wireshark |
Choose whichever method fits your workflow. Both give you the same Wireshark for Mac application.
Download the Universal .dmg from wireshark.org. Drag to Applications. Includes ChmodBPF and PATH helper.
Click the download button above. The Universal .dmg works on both Intel and Apple Silicon Macs.
Double-click the .dmg file. Drag the Wireshark icon to the Applications folder.
The .dmg includes Install ChmodBPF.pkg. Double-click it and follow the prompts. This sets permissions so Wireshark can capture packets without running as root.
This adds command-line tools (tshark, dumpcap) to your terminal PATH. Useful if you work from the command line.
Open Wireshark from Applications. Select your network interface (Wi-Fi or Ethernet) and click the shark fin icon to begin.
If you use Homebrew, this is the fastest path. Auto-detects your architecture and installs the correct build.
Important: brew install wireshark (without --cask) only installs the CLI tools (TShark). For the full GUI, use --cask wireshark.
ChmodBPF is separate. Even with Homebrew, you need to install wireshark-chmodbpf for packet capture permissions. Without it, Wireshark will show "no interfaces."
Updates: Run brew upgrade --cask wireshark to update to the latest version.
Wireshark for Mac maintains two active branches. Choose based on your macOS version.
| macOS Version | Wireshark 4.6.x | Wireshark 4.4.x | Apple Silicon |
|---|---|---|---|
| macOS 15 Sequoia | Supported | Supported | Native |
| macOS 14 Sonoma | Supported | Supported | Native |
| macOS 13 Ventura | Supported | Supported | Native |
| macOS 12 Monterey | Supported | Supported | Native |
| macOS 11 Big Sur | Not supported | Use 4.4.14 | Native |
| macOS 10.15 Catalina | Not supported | Not supported | N/A (Intel only) |
Apple Silicon (M1, M2, M3, M4) is natively supported since Wireshark 3.6.0. The Universal .dmg includes both Intel and ARM64 binaries — macOS automatically runs the correct one.
These are the most common issues when using Wireshark for Mac. Most relate to ChmodBPF and permissions.
This is the most common Wireshark for Mac issue. It means the Berkeley Packet Filter (BPF) device permissions aren't set correctly. Wireshark for Mac needs ChmodBPF to access network interfaces for live capture.
Fix: Install ChmodBPF from the .dmg package (it's included alongside the app) or via Homebrew:
Quick temporary fix (resets on reboot):
macOS updates sometimes break ChmodBPF's launch daemon. Symptoms: interfaces disappear, or the ChmodBPF installer reports success but nothing changes.
Fix: Remove and reinstall ChmodBPF:
Then reboot your Mac. If the issue persists, run ChmodBPF manually:
Your user account isn't in the access_bpf group, which ChmodBPF creates. Check with:
If it doesn't show access_bpf, add yourself:
Log out and back in (or reboot) for the group membership to take effect.
On macOS, the Wi-Fi interface (en0) can only capture your own traffic by default. To capture all wireless frames (monitor mode), you need to use macOS's built-in Wireless Diagnostics tool first, or use the airport command:
This captures 802.11 frames on channel 6. The resulting .pcap file can then be opened in Wireshark. Note that this disconnects you from Wi-Fi during capture.
macOS Gatekeeper may block Wireshark if downloaded from a browser. Right-click the app in Applications and select "Open" to bypass the warning for the first launch. You'll see a dialog asking to confirm — click "Open." After this, the app opens normally.
wireshark-chmodbpf).brew and want easy updates with brew upgrade. With Homebrew, remember to also install the wireshark-chmodbpf cask separately.airport command or macOS Wireless Diagnostics. This disconnects you from Wi-Fi during the capture.tcpdump comes pre-installed on every Mac. However, for deep protocol analysis across all network layers, Wireshark remains the most comprehensive free tool available./Library/Application Support/Wireshark and /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist. If installed via Homebrew, run brew uninstall --cask wireshark and brew uninstall --cask wireshark-chmodbpf.Wireshark for Mac is the most complete packet capture tool, but these alternatives serve specific needs.
Pre-installed on every Mac. Fast, lightweight, scriptable. Capture to .pcap and open in Wireshark. Best for: remote capture, automation.
Native macOS app for debugging web traffic. Modern Swift UI, Apple Silicon native. Best for: API debugging, iOS app development.
Industry-standard debugging proxy. Cross-platform, extensive documentation. Best for: enterprise teams, throttling simulation.
For full-depth protocol analysis (not just HTTP), Wireshark for Mac remains the gold standard. Need the Windows or Linux version? Download Wireshark from our main page.